Bind guest reconnect authorization to the runner control connection

[jiashuoz]

Runner reconnect authorization now performs begin, guest proof exchange and acceptance through one captured agent connection. A control redial, local boot/placement replacement or deadline invalidates the attempt instead of moving its proof onto a replacement socket.

The optional driver host callback validates shared RPC responses, uses one five-second budget, limits work to one active attempt per session and 64 per runner, releases pending calls on failure, and returns only fixed errors with zero authority. The guest relay explicitly refuses begin/accept by method name alongside the existing high-bit origin guard. The design note documents the caller contract and remaining integration work.

This PR targets feat/guest-reconnect-rpc (PR113). Merge that prerequisite, then rebase/retarget this branch to main. No capability is advertised or guest listener enabled. Guest key custody/enrollment, cold-resume placement ordering, current configuration delivery, bounded peer handling and relay takeover remain required before live qualification. Hosted integration additionally depends on Cloud PR146/147/148.

Verification covers real agent WebSockets, signed round trip, wrong scope, strict decoding/refusals, guest-origin refusal, cancellation, late proof, admission limits, and replacement sockets/instances. A separately built callback consumer exercises success, wrong scope and revoked authority over the real runner control connection using a synthetic driver and proof provider; this is executable callback coverage, not a live VM continuity claim.

Local validation: full runner package race tests passed; focused reconnect race tests passed; build/vet passed; separately built execution probe passed. Local full verify encountered an existing latency cleanup timing failure (passed isolated) and a Docker registry timeout while obtaining the required test image. Full Linux CI is required before integration.

Final validation: Linux CI run36724284130 is fully green (full make verify, non-root jail ownership, CLI/client race checks, fleet syntax). Post-CI built callback execution passed. Independent and adversarial reviews both passed with no required findings. Both retained the documented pre-enablement requirements: cancellation-safe proof I/O, instance/epoch-bound configuration and relay installation, and cold-resume placement reconciliation.