chore(sync): zsy_developcc 全量同步至 qyqy_develop（W26 口径）

- 分支内容对齐 qyqy_develop b6ec3aa，树完全一致（同步后 git diff 为空）
- 覆盖本轮全部交付：客服 Agent 重构（安全路由 / 五出口 / 记忆与画像 / RAG 全链路）
  + 开发文档 62 份编号体系（D1.1 v1.17 索引）
  + 新增 D2.10-客服Agent端到端答辩文档-2026-09-21.html
- 基线：e239eb7（2026-09-17 品牌口径统一快照），本提交为其直接后继

app/api/controllers/agent_runs.py

@@ -1,7 +1,7 @@
 from collections.abc import AsyncIterator
 from dataclasses import asdict
 
-from fastapi import APIRouter, Depends, Request, status
+from fastapi import APIRouter, Depends, Path, Request, status
 from sqlalchemy.ext.asyncio import AsyncSession
 from starlette.responses import StreamingResponse
 
@@ -52,7 +52,8 @@ async def create_agent_run(
 
 @router.get("/{run_id}", response_model=AgentRunStatusEnvelope)
 async def get_agent_run(
-    run_id: str, context: RequestContext = Depends(build_request_context),  # noqa: B008
+    run_id: str = Path(min_length=1, max_length=64, pattern=r"^[A-Za-z0-9_-]+$"),
+    context: RequestContext = Depends(build_request_context),  # noqa: B008
 ) -> AgentRunStatusEnvelope:
     """查询运行（文档 §6.3）。
 
@@ -70,8 +71,8 @@ async def get_agent_run(
 
 @router.get("/{run_id}/events")
 async def stream_agent_run_events(
-    run_id: str,
     request: Request,
+    run_id: str = Path(min_length=1, max_length=64, pattern=r"^[A-Za-z0-9_-]+$"),
     context: RequestContext = Depends(build_request_context),  # noqa: B008
 ) -> StreamingResponse:
     query = RunQueryService()