fix(runner): separate failed operations from process shutdown status

[adrianwebb]

Outcome

Keep handled background operation failures from poisoning the runner's graceful process exit. Deployment's strict zero-exit drain check remains intact.

Work authority

• Work item / Issue: Keep background operation failures separate from runner process shutdown status #303; Diagnose and recover operations-runner OpenBao trust after boot deployment#633

• Proposal / decision: User-directed reboot recovery before Identity migration; Platform #467.

• Assignment / checkpoint: N/A — direct local user instruction, not a TreeSeed assignment.

• Actor: Codex acting through authenticated adrianwebb.

• Human authority: adrianwebb authorized staging fixes and managed recovery.

• Agent / capacity provider: N/A — local Codex task, not a delegated provider assignment.

• Exact base ref: staging 0b2cf9b

• Exact head ref: codex/runner-exit-status 16133aa

• Agent-authored under human authority

Plan

Reproduce the sticky exit-status source defect; move status handling to one-shot execution; add regression coverage; verify in Actions. Keep live authentication unchanged and track managed runner/reboot acceptance separately.

Changes and commits

16133aa removes process-global exit mutation from shared polling and retains failure status for one-shot commands. Four regression cases complement the existing graceful-drain test.

Verification

Five tests pass: npm run test:control-plane -- tests/unit/control-plane/release/runner-operation-exit.test.ts tests/unit/control-plane/release/runner-drain.test.ts.
npm run build:dist passed. Git diff whitespace check passed. Full Verify Actions: https://github.com/treeseed-ai/api/actions/runs/34402252812 (in progress).

• I ran the narrowest relevant package verification and documented any checks that could not be run.

Risk and rollback

No data/schema/authentication changes. One-shot failures remain nonzero; successful polling never clears unrelated fatal status. Revert this commit through a staging PR if needed. Do not deploy current API staging wholesale because it contains pending Identity changes; use compatible runner development acceptance before coordinated cutover. No purge or credentials reset.

Completion summary

Source fix and focused tests complete; required Actions and managed acceptance remain. Current host was restored through manager restart after failed unattended rc284 boot. Do not equate manual recovery or this source PR with cold-boot acceptance.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.