[syscod3]

Implements Stage 2 of the merged runner lifecycle plan.

• reads the exact runner Secret through the uncached reader
• persists only non-secret handoff/exit/failure state
• retains the Secret until unary Exec returns, then deletes idempotently
• treats missing Secret and restart ambiguity as do-not-replay
• keeps payload exclusively in ExecRequest.Env
• regenerates the ImpVM CRD/deepcopy artifacts

Deferred: Stage 3 deadline cleanup, Stage 4 rollout gate, and Stage 5 E2E verification.

Validation: make test passed; Linux runnerlaunch tests cross-compiled with GOOS=linux GOARCH=amd64 go test -c. Helm unittest has unrelated baseline failures in image expectations and webhook counts.

[syscod3]

Superseded by the staged handoff implementation now on main: #89/#90, with the follow-up cleanup correction in #92. Closing this conflicting duplicate.