Prepare protected ARC runner-group capability verification #4599

🤖 Generated by the Agentic Engineer

Prepare a reviewed, protected-main command that can prove the existing App's runner-group capability after the production transport and identity prerequisites pass. Operators need an executable proof before deciding whether the inactive runner pool can serve KSail; synthetic fixtures alone cannot decide account capability.

Deliver the source and manual workflow for #4597. Keep #4597 open for actual native API proof and the resulting capability decision.

Acceptance:

• Preserve feat(arc): verify transport health without credential access #4582's existing identity and transport modes. Add the group callback only after all existing App/installation identity and permission checks; deferred credential cleanup failure still overrides a callback result.
• Keep credentials inside the process and print fixed verdicts. Prove narrow repository/workflow policy, complete inventory, zero runners, exact invocation-owned deletion and token revocation with credential-free positive/negative HTTPS fixtures.
• Smoke-test the compiled command's two new modes and both existing identity modes. Preserve malformed response, uncertain write, no write retry, cancellation and cleanup-failure rejection controls.
• Reuse the existing PR fixture job; add only the new workflow watch path. The protected production workflow is manual-only, main-only, first-attempt-only, and retains the production environment and deployment lock.
• Pass exact-head CI and substantive review. Land feat(arc): verify transport health without credential access #4582 first, and rebind the source to actual protected main before this change's queue entry.
• Source delivery does not establish production capability or authorize execution, new Apps/grants, runner activation, workflow allow-list expansion, routing or spend. Native execution remains gated on Complete encrypted credential transport before ARC activation #4570/fix(arc): encrypt credential transport before runner activation #4575 delivery, corrected same-node TLS and existing-App identity proof.

Part of #4597. Size: M.

Source readiness is separate from native acceptance. PR #4600 is now at signed head bfdd8419ff2cc7201b43dedc107cd1165e64ee1e, integrating reviewed main 944a1463589ac769a92e8d5d5168711f1d142813. It also repairs the credential-free transport positive control for #4570, without changing workload denial challenges or granting execution. The new fixture reproduced the HTTP health failure before the fix; all 39 orchestration cases, affected Go race tests, Go vet and ShellCheck now pass locally. Hosted CI and substantive review must be renewed at this head before promotion.

The earlier generated queue-hold paragraph conflated source preparation with native execution. The original acceptance above requires #4582 source delivery before queue entry; it explicitly leaves actual transport, identity and capability acceptance to #4570 and #4597. Those runtime prerequisites remain required before any native runner-group execution. #4597 remains open and blocked by #4570; source merge will not complete either native outcome.