Add privileged worker entrypoint stage markers

[cbusillo]

Summary

• emit fixed JSON markers when the privileged worker entrypoint starts and when its isolated startup probe succeeds
• allow both markers only as diagnostic runtime evidence; neither can satisfy activation proof
• cover successful and timed-out probe ordering in shell tests and docs

Why

The exact worker image runs locally through poll_succeeded, while production event-filtered reads find no Python lifecycle marker. Shell-level markers let the protected inspector distinguish a blocked startup probe from a block between probe completion and continuous Python worker startup without exposing general logs.

Validation

• focused entrypoint/runtime/HTTP tests (35 tests)
• uv run --extra dev launchplane ci unittest-shard local (3,080 targets; 12/12 shards)
• uv run --extra dev mypy control_plane tests (759 files)
• Ruff, format, ShellCheck, and shfmt
• production image build
• real production-image entrypoint + disposable PostgreSQL smoke emitted both shell markers and all lifecycle events through poll_succeeded

Refs #2219