ci(track-a): bootstrap canonical runtime with completed contained toolroot

[blakinio]

Track A RUNTIME fresh-main bootstrap v4

Task: OTC-20260816-track-a-canonical-runtime-e2e
Base: exact trusted main@917b8ab943fd9aa1fded50c9a0b8b4e1dfeb5cbb after bootstrap/rebind/Gate-B implementation, hardened support-root resolver, live layout inventory, and contained x11vnc completion all reached terminal main state.
Execution: serialized physical synology-otclient-01 only.

This PR supersedes #381. Previous attempts failed closed before registration/login:

• ci(track-a): bootstrap canonical runtime from trusted main #376 acquired lease generation 1 then failed xvfb_unavailable;
• ci(track-a): bootstrap canonical runtime after toolroot repair #381 acquired generation 2 then failed toolroot_unavailable before WARP/X11/client.

The physical support root is now directly proven complete: repair run 31954295453 / job 95182427755 staged package-verified x11vnc into /work/_otclient_tibia_re_state/toolroot with SHA 4954921ae9c4e2bf7061603eb6a2d52c2292a0973eb2da5d6f48a9bd49570ffc, and trusted worker contract-test resolved that exact root.

This phase only

One fresh bootstrap attempt, no account credentials/login:

1. authoritative registration/session precheck;
2. acquire canonical lease for this task/session;
3. trusted-main bootstrap re-proves absence/uniqueness under flock;
4. create exact-fenced persistent client + X11 + localhost-only VNC + canonical-owned WARP helper;
5. atomically publish registration;
6. immediate same-generation Gate B;
7. release controller authority while leaving the registered runtime idle.

Any new fail-closed discriminator stops the phase; no blind retry. Track B and historical #303 surfaces are excluded. No owner-funded Codex/OpenAI API/paid quota is used.