[syscod3]

Summary

• rebuild Stage 2 guest-agent runner handoff on healthy main (4b6ea054)
• keep the JIT payload in the VM-owned Secret until unary guest Exec returns at runner exit
• persist only bounded, non-secret handoff markers/outcomes and refuse replay after an ambiguous handoff
• record bounded failure reasons for Secret, decode, dial, and guest Exec failures

Scope

This PR contains only Stage 2 — non-persisting guest-agent handoff. Later runner-pool/live GitHub job acceptance stages remain deferred.

Validation

• make manifests clean
• make lint passed
• go test ./... passed with envtest assets on macOS
• Linux runner-launch package cross-compiled successfully; Linux execution is covered by CI
• pre-commit hooks passed

Do not merge until the required checks complete successfully.

[syscod3]

Superseded by the staged handoff implementation now on main: #89/#90, with the follow-up cleanup correction in #92. Closing this conflicting duplicate.