Route Manager.Run through the synchronized reconnect path

[Luqueee]

Problem

In internal/tunnel/tunnel.go:175-192, Manager.Run calls connect directly when no client exists, bypassing the herd-safe reconnect path used by Dial and Watch.

Concurrent discovery, health checks, and forwarding activity can therefore race while installing or closing SSH clients.

Acceptance criteria

• Make Run use the same synchronized reconnect mechanism as Dial and Watch.
• Ensure a stale client cannot close a newer client.
• Preserve session cleanup and command output behavior.
• Add a concurrent regression test involving Run, Dial, and reconnect.