Admit hosted work only on a configured deployment

[SaladDay]

Two run states that production can no longer reach are removed, together with the test convenience that kept them alive. /v1 behaviour is unchanged.

Admission. placement.CheckAdmission refuses an unclaimed deployment, or one without a provider, with ErrNodeUnavailable. DecidePlacement without a provider does the same. In production /v1 still answers 503 execution_unavailable first, so only a request that races past that check sees the new error. The wrong comments, which said an unclaimed deployment admits everything and that Web setup claims it, are fixed.

Node-less, non-direct allocations.

• Deleted: the kept_at column and every query branch and guard that used it, KeepRuntimeAllocation, AllocationTx.Keep, Allocation.KeptAt and KeepAllocation.
• The two callers now use ExecutionOperations.CheckRunning(ctx, Allocation) (Allocation, error). It checks that the Session is undeleted, the device is bound and the allocation is running, and changes nothing. Only the call expressions changed.
• Migration 000096_configured_admission.sql adds a one-time upgrade guard and drops kept_at. The upgrade refuses while there are node-less, non-direct allocations or pending hosted Environments on an unclaimed deployment. There is no runtime constraint.
• Claim no longer refuses on leftover unclaimed work.

Worker. StartWorker requires ManagedRuntimes. Deleted: every nil arm, RequireUnclaimed, and the test that started a Worker without runtimes.

Dead modes.

• runtimehistory.CollectionOnRead and the history route's "not configured" 503.
• source_not_configured, removed from the /core/v1 enum, the client and the locales.
• The nullable coremetrics slot and daemon fields.
• NewRules returns the typed ErrPublicURLRequired for an empty URL.
• OpenAPI regenerated.

Tests.

• One shared test installation ID, services/core/tests/testdata/installation.id, read by both official_client.py and the Go Workers. The official-client CI step is back to its natural order.

• Hosted tests use configuredStore: an isolated database set up the way Web setup does.

• pgtest.OpenIsolated copies a migrated template database instead of migrating each copy. Migration and copying share one advisory lock, because Postgres refuses to copy a template while another session is connected to it.

• Per-test cipher literals are replaced by pgtest.CredentialKey.

• Timing:

  Package	Before	After
  tests/integration	~457 s	~400 s
  execution	~26.6 s	~13 s

Docs (en and zh): sandbox-provider.md, sandbox-deployment.md, core-errors.md, core-metrics.md, runtime-observability.md and runtime-observability-api.md. CONTRIBUTING.md mentions the template database.

Net: non-test −127 (of which −53 generated), test −241, docs −2.

Checks.

• go build and go vet; sqlc-generate and make openapi with no drift.
• The full integration package and every pgtest package, including all thirteen OpenIsolated packages in parallel on a fresh template.
• The SDK-gated set, and the official-client step in both orders on one database.
• The 000096 upgrade exercise: refused with the guard's message, then succeeds after cleanup, then down and up.
• check-names, links and translations; pnpm typecheck and test:web.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}