fix(templates): revert templates.go change from #1781 (duplicate of #1777)

PR #1781 relaxed the runtime allowlist to permit empty runtime
through, intending to preserve TestTemplatesList_LegacyTopLevelModel's
backward-compat surface. But PR #1777 (`a492d111`, landed before
#1781) had already addressed the same test failure via the opposite
approach: update fixtures to include valid runtime values, leaving
templates.go strict.

#1781 was written without grepping for parallel in-flight fixes
(operator error during the 2026-05-24 CTO-bypass session). Both
fixes ended up on main, with #1781 silently reverting #1777's
strictness intent for real production legacy templates while no
test now covers that path.

This revert restores templates.go to #1777's intended strict state.
templates_test.go fixtures (already updated by #1777) remain
unchanged and continue to pass. The narrow-catalog filter rejects
empty-runtime templates as #1777's product decision dictated.

Verified locally:
- `go test -run '^TestTemplatesList_' ./internal/handlers/` green
- `go vet ./...` clean

workspace-server/internal/handlers/templates.go

@@ -204,18 +204,9 @@ func (h *TemplatesHandler) List(c *gin.Context) {
 			return
 		}
 		runtime := strings.TrimSuffix(strings.TrimSpace(raw.Runtime), "-default")
-		// Empty runtime is the legacy / pre-runtime_config shape: those
-		// templates declare `model:` at the top level and never set
-		// runtime. TestTemplatesList_LegacyTopLevelModel pins the
-		// backward-compat contract that they keep surfacing. The
-		// narrow-catalog filter (a5211050) applies only when a runtime
-		// is declared — declared runtimes must be in the allowlist;
-		// absent ones fall through unchanged.
-		if runtime != "" {
-			if _, ok := knownRuntimes[runtime]; !ok {
-				log.Printf("templates list: skip %s: unsupported runtime %q", id, raw.Runtime)
-				return
-			}
+		if _, ok := knownRuntimes[runtime]; !ok {
+			log.Printf("templates list: skip %s: unsupported runtime %q", id, raw.Runtime)
+			return
 		}
 
 		// Model comes from either top-level (legacy) or runtime_config.model (current).