feat(FN-2920): improve remote tunnel setup and heartbeat scheduling

- Add cloudflared install/detection support in remote settings API, UI, and route tests
- Surface Cloudflare tunnel prerequisites in Settings modal with remote access docs updates
- Harden heartbeat runtime scheduling by avoiding stale timeout state and simplifying runtime timeout handling
- Expand CLI/core/dashboard/engine coverage for task lifecycle, agent health, and runtime heartbeat behavior
- Add changesets for heartbeat scheduling fixes and PR approval setting updates

Fusion-Task-Id: FN-2920

packages/engine/src/__tests__/agent-heartbeat.test.ts

@@ -4217,13 +4217,9 @@ describe("HeartbeatTriggerScheduler", () => {
       expect(scheduler.getRegisteredAgents()).toContain("agent-001");
     });
 
-    it("registers regardless of the legacy enabled flag (state is the source of truth)", () => {
-      // runtimeConfig.enabled is no longer honored by the scheduler — pause
-      // and resume happen through agent.state, and the agent:updated listener
-      // drives register/unregister. Callers that still pass `enabled: false`
-      // should not silently lose the timer.
+    it("does not register when heartbeat is explicitly disabled", () => {
       scheduler.registerAgent("agent-001", { heartbeatIntervalMs: 10000, enabled: false });
-      expect(scheduler.getRegisteredAgents()).toContain("agent-001");
+      expect(scheduler.getRegisteredAgents()).not.toContain("agent-001");
     });
 
     it("applies default 3600-second interval when intervalMs is undefined", async () => {