fix: the health probe gets a third answer, and stops holding the lock

[zcsizmadia]

Closes #437. #440 bounded the COM call; this is the rest.

Engine.Running returns (bool, error)

Both implementations collapsed a failed probe into false — and the reconciler's response to false is Engine.Start. So a wedged wslservice, a WSL update mid-flight, or any transient probe failure read as "the engine is down" and provoked a start of an engine that was almost certainly running.

That is also why the bound could not simply be added to tick. Bounding a two-valued Running converts "slow" into "down" — the same bug with a timer attached. The third answer had to come first.

(false, nil) now means definitely not running. Anything the probe could not determine is an error, and tick does nothing that round rather than guess.

Provisioner keeps both shapes: EngineRunning for the waitFor polls, where "cannot tell" and "not yet" both correctly mean keep waiting; EngineRunningErr for the caller whose next move is to start something.

The probe runs outside s.mu

tick held the mutex across Engine.Running with the supervisor's process-lifetime context, so a service that stopped answering parked the reconciler inside the lock: every Demand() blocked (docker commands hung rather than failing), LifecycleSnapshot froze so the tray could not show the supervisor was stuck, and the poke loop never ran again.

Now: probe outside, decide inside, 60 s ceiling on the probe. Generous deliberately — a cold wsl.exe --list on a loaded machine is not fast, and this is a ceiling for a probe that has stopped answering, not a latency target.

Moving it out opens a window where Demand can cold-start the engine between the probe and the decision. startGen closes it: tick captures the counter before probing and gives up the round if it moved. Start is idempotent so the stale case was survivable anyway — but "engine is down; starting it" logged about an engine somebody just started is how an operator stops believing the log.

Verification

Three negative controls, each run both ways:

control	result
probe error ignored	Start called 41 times in 400 ms against a running engine
probe back inside mu	Demand blocked behind a probe in flight
(#440) bound removed	the COM test times out at 45 s

Plus TestDefiniteDownStillStartsTheEngine, so this cannot have bought safety by quietly disabling the supervisor.