Point the "tenant isolation requires lease id" error at leases.allocate, and document providers that attach to an existing Limrun instance #3350

We drive an existing Limrun iOS instance from @e2e-dev/mobile 0.10 (agent-device 0.21.22), created by our harness and attached via LIM_IOS_INSTANCE_URL / LIM_IOS_INSTANCE_TOKEN. It works now: the provider calls leases.allocate in acquire and leases.release in release. Getting there took a while:

1. A DeviceProvider that returned the stateDir of a daemon set up with agent-device connect limrun silently fell back to the local simulator. The connection profile is only read by the CLI (connection-runtime.js), never by the SDK client.
2. Passing tenant / runId / sessionIsolation: "tenant" with a made-up leaseId gave INVALID_ARGS: tenant isolation requires lease id. Nothing in the error or docs points to leases.allocate.

Suggestions

• Make the error say something like: "tenant isolation requires a lease id from leases.allocate".
• A short example in the remote / Limrun docs of a provider attaching to a harness-owned instance:

  acquire: async (req) => {
    const scope = { tenant: "limrun", runId, leaseBackend: "ios-instance", leaseProvider: "limrun" };
    const lease = await createAgentDeviceClient({ session: `lease-${req.slot}` })
      .leases.allocate({ ...scope, platform: "ios" });
    return { id: lease.leaseId, client: { ...scope, leaseId: lease.leaseId, sessionIsolation: "tenant" } };
  },
  release: async (lease) => {
    await createAgentDeviceClient({}).leases.release({ ...scope, leaseId: lease.id });
  },

• Possibly warn when a stateDir has a connect limrun profile that the SDK client ignores.

Related: #2016 (same message on close).