Share one crypto-provider cache across hub mail senders (CL-7284)

[TheGreatAxios]

CL-7284

Chat sendMail, webhook launch, routine launch, and agent-definition
drafting each constructed their own createCryptoProviderCache.
Independent caches mint independent Ed25519 keys for the same string,
so the same workbench or instance id could sign mail with four
different keys.

Chat keys by workbench id; webhook, routine, and one-shot drafting key
by the launched run's instance id. Both are generateId("workflowRun")
(older workbenches: generateId("instance")), so they share a string
shape. generateId uniqueness keeps distinct entities from colliding;
separate caches still rotate the key for the same id across consumers.

Fix

Construct one TTL-bounded createCryptoProviderCache (CL-7223) in the
hub composition root and pass it into createHubChatPlatform, webhook
launch, the routine launcher, and one-shot drafting.
createHubChatPlatform no longer mints a cache of its own.

Testing

• bun test packages/folded-runs/src/crypto-cache.test.ts
• bun test packages/chat/test/platform-adapter.test.ts packages/chat/test/relaunch-close.test.ts
• bun run typecheck
• bun run check:structural

bun run check's full package test run hits pre-existing Postgres
28P01 against the local DATABASE_URL (unrelated DB-gated suites).

Fixes CL-7284

[TheGreatAxios]

Fixes CL-7284

[TheGreatAxios]

Self-review

Verdict: the fix does what the ticket asks — one process-wide CryptoProviderCache constructed in createHub and threaded into chat, webhook launch, the routine launcher, and one-shot drafting, replacing the three separate caches. Diff is minimal, in-style, and covered by both a unit test on the shared-cache behavior and a wiring pin in apps/hub/src/crypto-provider-cache-wiring.test.ts.

• DISMISSED: field-name inconsistency across consumers (cryptoProviders in chat/one-shot deps vs cryptoProviderCache in webhook/routine deps) — checked, these are pre-existing dependency-type names, not introduced by this PR, and each callsite passes the same cryptoProviders instance correctly.
• DISMISSED: no exactOptionalPropertyTypes/as T/bare-catch issues in the diff — the change only replaces cache construction sites and adds a required constructor param.
• DISMISSED: comment volume added at each call site — each explains a non-obvious "why" (id-family collision across independent caches), not a restatement of code.

Targeted tests run (all pass):

• bun test packages/folded-runs/src/crypto-cache.test.ts — 6 pass
• bun test packages/chat/test/platform-adapter.test.ts packages/chat/test/relaunch-close.test.ts — 54 pass
• bun test apps/hub/src/crypto-provider-cache-wiring.test.ts — 1 pass
• bun run typecheck — exit 0

No fixes needed; nothing pushed.

[linear-code]

CL-7284