Add worker runtime evidence diagnostic boundary

[cbusillo]

Summary

• allow the fixed worker startup and store-build lifecycle markers through protected runtime inspection as diagnostic-only evidence
• emit a one-time store-build boundary immediately after worker startup
• lock every non-poll lifecycle event out of activation proof and document the diagnostic boundary

Why

Production inspection of the exact deployed worker image consistently returns one candidate log line while the same image emits the full lifecycle against disposable PostgreSQL locally. This change distinguishes a worker blocked before store construction from a bounded Dokploy log-read visibility problem without exposing raw logs, container configuration, or environment values.

Validation

• uv run --extra dev python -m unittest tests.test_dokploy_runtime_evidence tests.test_dokploy_target_runtime_inspect tests.test_privileged_operation_worker
• uv run --extra dev launchplane ci unittest-shard local (3,080 targets; 12/12 shards)
• uv run --extra dev mypy control_plane tests (759 files)
• changed-file Ruff and format checks
• production image build
• real entrypoint + disposable PostgreSQL smoke through privileged_operation_worker_poll_succeeded
• direct continuous-worker startup without probe evidence refused
• independent exact-diff reviews; JetBrains inspection remained stale/UNKNOWN after its one maintained retry

Refs #2219