Fix native workflow completion and runtime behavior

[cbp175]

Summary

This fixes several native-mode issues found while running FrontierAgent directly on a non-containerized Linux host.

• Accept workflow-certified no_tool completions when the final answer is explicitly marked complete and sourced from the agent, without broadly treating every workflow no_tool exit as successful.
• Surface authoritative workflow telemetry (turns_used and tool_calls_count) instead of deriving turns from react_steps and reporting zero tool calls.
• Preserve absolute project paths for read_file when the user project cwd differs from the workflow's private runtime workspace.
• Treat same-UID execution as expected for ordinary non-root native mode, avoiding redundant tool-user isolation warnings while preserving root-native, container, and FRONTIER_AGENT_REQUIRE_TOOL_USER=1 behavior.

Compatibility

Existing workflow behavior is preserved where the new authoritative telemetry fields are absent:

• turns fall back to len(react_steps)
• tool calls fall back to 0

The native same-UID exception is limited to:

• native mode
• POSIX
• non-root execution
• no explicit strict tool-user requirement

Validation

Tested with FrontierAgent running natively on Bluefin 44.

Automated verification:

apodex/tests/test_features.py  88 passed
apodex/tests/test_native.py    14 passed
git diff --check               PASS

Live native validation also confirmed:

• Stateful ReAct no_tool finalization is delivered as a completed answer.
• Outer workflow telemetry matches authoritative inner-loop counters.
• read_file can access absolute paths in the real project while the workflow uses a separate private workspace.
• Ordinary non-root native execution retains the existing native-mode safety notice without emitting redundant same-UID/tool-user warnings.