fix(agent): guard internal Aion CLI command overrides

[kaizhou-lab]

Summary

• reject command overrides for the internal Aion CLI agent
• ignore and mask legacy Aion CLI command overrides at registry/read time
• add migration 016 to clear polluted internal Aion CLI override data

Tests

• CARGO_TARGET_DIR=/tmp/aioncore-codex-target cargo test -p aionui-ai-agent decode_row_ignores_internal_aion_cli_command_override
• CARGO_TARGET_DIR=/tmp/aioncore-codex-target cargo test -p aionui-app --test agent_integration_e2e internal_aion_cli_rejects_command_override
• CARGO_TARGET_DIR=/tmp/aioncore-codex-target cargo test -p aionui-db --test cron_assistant_first_migration migration_016_clears_internal_aion_cli_command_override_only
• CARGO_TARGET_DIR=/tmp/aioncore-codex-target cargo fmt --all -- --check
• CARGO_TARGET_DIR=/tmp/aioncore-codex-target cargo test -p aionui-ai-agent
• CARGO_TARGET_DIR=/tmp/aioncore-codex-target cargo test -p aionui-db
• CARGO_TARGET_DIR=/tmp/aioncore-codex-target cargo clippy -p aionui-ai-agent -p aionui-db -p aionui-app -- -D warnings
• CARGO_TARGET_DIR=/tmp/aioncore-codex-target cargo test -p aionui-app --test agent_integration_e2e
• CARGO_TARGET_DIR=/tmp/aioncore-codex-target just push -u origin fix/internal-aion-cli-override-guard

Investigation notes

Sentry #81 shows PUT /api/agents/632f31d2/overrides polluted the internal Aion CLI row with command_override values like a web URL and irm https://claude.ai/install.ps1 | iex. The backend must treat this internal commandless agent as non-overridable regardless of caller.