feat(control): coordinate approved builders and hardware targets

[zoeyrose]

Summary

Extend the control plane from one automatic home deployment target into a
general, capability-scoped registry for builders, deployers, and real-hardware
validation hosts.

Implementation / behavior

• Model targets, capabilities, artifacts, jobs, approvals, leases, and
  operator-visible results as separate contracts.
• Add an explicit approval workflow for an official main server; normal
  mainline merges must never authorize that target.
• Add isolated builder jobs for reviewed artifacts and exact source commits.
• Add a GPU benchmark operation that runs only an approved benchmark artifact
  and returns bounded hardware, driver, backend, and result evidence.
• Separate builder credentials and network access from deployment credentials
  and persistent game state.
• Add cancellation, expiry, retry, audit, and revocation behavior.
• Store only the minimum host identity and benchmark data required for
  reproducible results and operational diagnosis.

Acceptance criteria

• A target capability set is enforced both by the Worker and by the agent.
• Official deployment requires an exact digest and auditable administrator
  approval.
• Builder and GPU agents cannot access official server state or deployment
  secrets.
• Job and result contracts are versioned, replay-safe, and covered by
  deterministic tests.
• Existing qualified GPU runner work in github-settings issue 77 is reused
  rather than replaced with weaker labels or emulation.

Dependencies

• Parent:
  feat(control): implement NAT-friendly agent control plane #2
• Initial webhook and target protocol:
  feat(webhook): receive verified GitHub events and persist target state #3
• Initial host agent:
  feat(agent): implement the NAT-friendly Classic deployment agent #4

Non-goals

• Do not make self-hosted runners a requirement for ordinary pull requests.
• Do not treat a hardware agent as trusted merely because it is registered.