Automate Linux ephemeral runner image reconciliation

[jmcte]

Summary

• add reconcile-linux-pool for Synology and dedicated Linux Docker pools
• verify the configured GHCR image tag and immutable package version ID before changing capacity
• drain active runners, force image pull/recreate/orphan cleanup, and persist successful per-plane state atomically
• serialize concurrent reconciliations with a PID-backed lock and remove only stale locks
• add dry-run behavior, duplicate-signal decision tests, malformed-state protection, and operator documentation

Governing Issue

Refs #149

Issue #149 already captured disabled-update runner freshness; this PR adds the requested automated Linux/Synology pool rollout path without duplicating the issue.

Validation

• pnpm exec vitest run test/reconcile.test.ts test/cli.test.ts (37 tests passed)
• pnpm test (49 files, 276 tests passed)
• pnpm lint
• pnpm build
• git diff --check
• Full test suite was rerun with loopback access because three existing integration tests require local mock servers.

Bootstrap Governance

• Changes are scoped to the linked issue.
• No real secrets, runtime auth, or machine-local env files are committed.
• The existing unrelated .github/pull_request_template.md worktree edit was intentionally left unstaged and is not part of this PR.
• PR author approval is intentionally not supplied; this PR requires an independent review.

Risk and rollout

• The command is opt-in and must be run from a trusted checkout or host timer.
• Image verification and the drain gate happen before Compose mutation.
• A failed verification, drain, or install does not advance reconciliation state.
• The release workflow or workflow_job: completed receiver should enqueue this command; job completion must not mutate a live runner directly.
• This PR does not perform a live pool rollout.

Merge Automation

• Enable auto-merge after required checks and independent review are satisfied.

Notes

The running ephemeral runner remains on --disableupdate, finishes its job, and deregisters normally. New containers receive the updated image after reconciliation.

[athena-omt]

Reviewed the Linux pool reconciliation command. The command verifies the configured image tag against GHCR before any mutation, serializes each run with a live-PID-aware lock, drains runner pools before reinstalling with forced image pulls, and writes the reconcile ledger only after successful apply.

Validation run on the refreshed PR head:

• pnpm vitest run test/reconcile.test.ts test/cli.test.ts
• pnpm lint