Prepare v0.3.1 release

[joecklau]

Release intent

Merge the validated develop branch into main as the source commit for the planned v0.3.1 source-only release. This PR does not create the tag or GitHub Release.

Included changes

• Prevent hung provider inventory and health operations from starving host-trust lease renewal.
• Quarantine affected local capacity and fence only the exact GitHub runner registration when trust maintenance fails.
• Preserve and validate immutable runner identity during restart reconciliation, rejecting unknown or mismatched registrations.
• Bound steady-state supervision work and apply fail-closed handling during initial lease maintenance.
• Document safe recovery from an already-held controller configuration lock and clarify lease-failure behavior.

Validation

• PR Fix host-trust supervision during provider hangs #33 completed all 12 required checks successfully before its merge into develop.
• Focused pool tests and race tests passed, and independent verification found no P0-P2 blockers.
• A live Docker Sandboxes canary passed, and a two-runner pool remained responsive beyond a full lease lifetime with fresh leases on both guests.
• The release workflow will test the exact annotated v0.3.1 commit again before publishing.

After merge

Create and push annotated tag v0.3.1 at the resulting main commit, then manually dispatch the source-only Release workflow with the required confirmation. Tagging and release publication remain separate approval steps.