feat: add fenced Omnigent managed-host leases

[dgokeeffe]

What does this PR do?

Adds the CoDA side of Omnigent managed-host leasing:

• fenced user lease acquisition, session workspaces, idle release, and runner-aware retention;
• service-principal allowlisting based only on the Apps-proxy-forwarded access token;
• managed host/runner diagnostics and stable relaunch behavior;
• workspace-specific Omnigent URL, wheel, and server-client-ID resources without committing deployment identifiers;
• process-tree handling that distinguishes the persistent zygote from live runners.

Companion Omnigent Beads epic: omnigent-90n.

Testing

• Deployed and tested on dogfood
• Added a screenshot to this PR

Verification:

• 600 passed, 1 skipped in the CoDA unit suite.
• Deployed exact commit b30dd5bd591498811bdc3d0c4711df7a5d1e2582 to both coda-main and coda on daveok.
• Exact-head Omnigent live Pi sessions rendered successful assistant responses through coda-main.
• Independent standby session succeeded through coda with a distinct host identity.
• Evidence screenshots: /tmp/managed-coda-evidence/final-ac99f0cd-head-success.png, /tmp/managed-coda-evidence/final-ac99f0cd-two-session-success.png, and /tmp/managed-coda-evidence/managed-coda-standby-success.png.

[dgokeeffe]

@pietern, this companion PR is deployed at exact head on two standing CoDA apps and has 600 passed, 1 skipped locally. Please review when available; the Omnigent companion is omnigent-ai/omnigent#4384.