ci(track-a): bootstrap canonical runtime after toolroot repair

[blakinio]

Track A RUNTIME fresh-main bootstrap

Task: OTC-20260816-track-a-canonical-runtime-e2e
Base: exact trusted main@67e5dc88ff4d6c241d90a046527dac4aa9f831d8 after canonical bootstrap #371/#375 and toolroot repair #379/#380.
Execution: serialized physical synology-otclient-01 only.

This PR supersedes failed/stale #376. The prior physical attempt reached the real runner, acquired lease generation 1 and failed closed before X11/client registration with xvfb_unavailable; transition rollback semantics killed the bootstrap-owned group and invoked worker rollback, and no registration was published. The support-toolroot defect was then repaired/promoted/archived on trusted main.

This phase only

Exactly one fresh bootstrap attempt, without account credentials/login:

1. inspect authoritative lease and registration state;
2. refuse bootstrap if a registration already exists;
3. acquire canonical lease for this task/session;
4. invoke trusted-main bootstrap, which re-proves registration/candidate absence under lock;
5. create one persistent exact-fenced client + X11 + localhost-only VNC + canonical-owned WARP helper;
6. commit authoritative registration and pass same-generation Gate B;
7. release controller authority while leaving the registered runtime idle.

Any new fail-closed discriminator stops the physical phase; no blind retry. Track B and historical #303 surfaces are excluded. No owner-funded Codex/OpenAI API/paid quota is authorized or used.

[blakinio]

Coordinator disposition: SUPERSEDED by fresh-main RUNTIME PR #386 after live support-layout inventory #382/#383 and contained x11vnc completion #384/#385. #381 remains historical fail-closed evidence only: run 31953635875/job 95180815033 acquired lease generation 2 and stopped at toolroot_unavailable before WARP/X11/client, with no registration/login. Do not retry this stale branch.