Harden runner registration boundary

[cbusillo]

Summary

• Keep runner registration non-mutating while hardening the Launchplane-only boundary for the future durable maintainer.
• Route workflow confirmation/mutate inputs through environment variables, preserve failure artifacts with a fallback result JSON, and stop allowlisting a user-provided registration root.
• Require explicit GitHub token and Launchplane Actions execution context in the registration CLI before executor work.
• Validate host/lane/label identifiers before any future path/systemd derivation can use them.

Non-goals

• This does not add live runner registration, run.sh, nohup, systemd mutation, or product-repo workflow adoption.
• cm-website remains a proving target only; no product repo files were touched.

Validation

• uv run python -m unittest tests.test_runner_lane_registration
• uv run --extra dev ruff format --check control_plane/contracts/runner_lane_registration.py control_plane/workflows/runner_lane_registration_executor.py control_plane/cli_runner_lanes.py tests/test_runner_lane_registration.py
• uv run --extra dev ruff check control_plane/contracts/runner_lane_registration.py control_plane/workflows/runner_lane_registration_executor.py control_plane/cli_runner_lanes.py tests/test_runner_lane_registration.py
• uv run --extra dev mypy control_plane/contracts/runner_lane_registration.py control_plane/workflows/runner_lane_registration_executor.py control_plane/cli_runner_lanes.py tests/test_runner_lane_registration.py
• actionlint -config-file .github/actionlint.yaml .github/workflows/runner-lane-registration.yml
• git diff --check
• uv run python -m unittest tests.test_runner_lane_registration tests.test_runner_lane_inventory tests.test_service tests.test_filesystem_store tests.test_postgres_store (619 tests OK)