Fix host-trust supervision during provider hangs

[joecklau]

Summary

Fix a pool-supervision failure where a hung Docker Sandboxes inventory or health operation could block the shared supervisor, starve 30-second host-trust lease renewal, and leave a runner GitHub-assignable after its 90-second guest lease expired.

• Bound steady-state host-trust, liveness, inventory, diagnostics, reconciliation, over-capacity, and replacement work so one stuck provider operation cannot indefinitely starve lease maintenance.
• Quarantine affected physical capacity and fence only the exact GitHub runner registration when host-trust transport or lease maintenance fails.
• Hydrate and validate immutable runner IDs during restart reconciliation, rejecting zero-ID adoption and same-name identity replacement.
• Extend the initial lease keeper with the same fail-closed quarantine and exact-registration fencing behavior.
• Add regression coverage for lease failures, exact-ID fencing, restart identity recovery, and mismatched runner identities.
• Include two incidental hygiene changes: generalize the agent scratch-path example and use a neutral example hostname in a Docker Sandboxes policy fixture.

Validation

• go test ./internal/pool
• go test -race ./internal/pool
• go test ./... (one existing timing-sensitive Docker Sandboxes keepalive test failed only under full-suite load; isolated rerun passed 5/5)
• Independent final verification found no P0-P2 blockers.
• Live Docker Sandboxes canary: https://github.com/solutionforest/ephemeral-action-runner-test/actions/runs/31688472557 (passed in 19 seconds)
• Live two-runner pool remained responsive beyond a full lease lifetime, with fresh lease expirations read back from both guests.

Checklist

• I kept credentials, private keys, tokens, and machine-specific configuration out of this pull request.
• I added or updated tests where behavior changed.
• I updated relevant documentation. No operator-facing configuration or command changed; the operational behavior is covered by code comments and regression tests.
• For provider or onboarding changes, I followed the Development and Extension Principles and documented and tested every intentional exception.
• I read and followed the contributing guide and code of conduct.