Add first-class Runner config control

[yyjeqhc]

Summary

• Add first-class runner_config_check and fenced runner_config_reload against each exact Runner process's startup-bound config path.
• Keep check side-effect free and share reload semantics with the existing authoritative ReloadableRunnerConfig / Unix SIGHUP path.
• Fence reload by expected generation, exact Runner incarnation, and explicit runner_config_control capability, with fail-closed old-Runner behavior.
• Preserve dispatch certainty (not_started vs outcome_unknown) and report restart-required startup-only fields explicitly.
• Add minimal runner:manage authority and document the edit → check → reload → runtime_status workflow; reload never writes config files.

Review and latest-main integration

Fresh review had already found no architectural blocker. This branch was then rebased onto current main including #311, #312 and #313.

#313 added the independent structured_cargo_test_execution_policy Runner capability, while this branch adds runner_config_control. That exposed one concrete integration bug: ALL_RUNNER_FEATURES contained 55 entries while its fixed array cardinality still declared 54. Reviewer follow-up commit 6a468563 updates the exact cardinality to 55. No other semantic conflict was found.

Fresh validation after rebase/fix

• Runner config reload suite: 11 passed / 0 failed
• Runner registry config fencing: 2 passed / 0 failed
• Server/root runner-config tests: 3 passed / 0 failed
• cargo check --all-targets -p webcodex-runner: passed; only the existing detached_job.rs::state_path_for_job dead-code warning
• cargo check --all-targets -p webcodex: passed, 0 errors / 0 warnings
• cargo fmt --all -- --check: passed
• git diff --check and staged diff check: passed

A full cargo test -p webcodex-runner-registry also exited 0 with 242 passed / 0 failed, but the newly merged #313 strict test-count evidence correctly marked the tool-level count assertion unproven because its bounded stdout projection was truncated. The focused 2-test registry proof above is complete and authoritative for this change.

No deploy, Runner restart, release, or branch-protection changes.