Add suspended warm server pools

[neebs12]

Summary

• reuse suspended Lambda MicroVMs with a fresh GitHub JIT registration per job
• support explicit no-DynamoDB sessions and DynamoDB-backed concurrent pools
• use one server lifecycle input/output, informational warm-hit, request-local capacity, fenced leases, and on-access recovery
• add max-lifetime-seconds with a 2-hour default and 8-hour ceiling
• bootstrap and tear down the on-demand warm-state table without Terraform
• retain the production vfs fallback and document its storage tradeoff
• split orchestration into focused start, stop, lifecycle, pool, cleanup, runtime, output, and type modules behind the stable public façade

Verification

• npm run check: 84 TypeScript tests, Quickstart script tests, 24 supervisor tests, lint, types, format, and bundled Action
• npm run test:image: ARM64 runner image smoke gate, including forced vfs
• explicit suspend/resume, cache, Node 24, and Redis E2E
• DynamoDB discovery and fenced release E2E
• two-member atomic capacity and bounded rejection E2E
• on-access replacement of two terminated stale members
• forced vfs cache persistence and Redis across suspend/resume
• current-commit native container: and services: E2E: GitHub-created Node 24 job container, Redis health gate, service DNS alias, protocol PONG, and clean container/network teardown
• post-refactor three-job warm-server E2E: immutable refactor commit, exact MicroVM reuse across fresh JIT runners, Docker cache persistence, Redis across resume, native Node 24 container: plus services:, and terminal cleanup
• 10-fresh/50-resumed exact-job benchmark: all 60 jobs verified; complete-job p50 was 16.31 s fresh and 3.17 s resumed, with raw JSON and generated statistics published
• earlier nine-server warm build-cache benchmark: 45.12x p50 exact Docker cache hit before suspend and 46.94x after the first post-resume rewarming build
• teardown dry run and applied teardown verified zero repo secrets, variables, runners, IAM user, table, images, and artifact bucket
• exact-job benchmark cleanup verified zero non-terminal MicroVMs, benchmark images, temporary IAM roles, log groups, and S3 bucket

Notes

The private E2E workflows pin immutable full commit SHAs. The large Node 24 base image fits the preferred overlay2 path, while forced vfs uses a smaller Alpine proof because full layer copies can exhaust the 2 GiB runner filesystem.

The exact-job benchmark checkpoints each lane to a private S3 object after every completed job, outside workload timers. The published report calls out correlated samples, unchanged-input scope, observed 8.4 GB guest memory, npm tail behavior, and shell-harness control-plane overhead.

This PR is intentionally not merged by the implementation agent.