Per-program supervisor sections. The non-root entrypoint installs into its
private `/run/agent/supervisord.d` only the ones whose config was rendered for
this agent: hermes, fleet-roster and litellm always; acp2api when
`/config/acp2api.yaml` exists. Topology is data -- the presence of a rendered
config file IS the on-switch.
