fix: reconcile interrupted relaunch tasks

[sjug]

Summary

• Mark stale provisioning tasks failed when startup reconciles an interrupted managed llama.cpp relaunch.
• Repair both newly transitioned relaunching nodes and existing relaunch_failed records, covering gateways that crash between node and task persistence.
• Preserve the task start time and unknown future fields while recording the interrupted step and a teardown-required error.
• Use a one-shot modification-revision CAS so concurrent or newer task records are never overwritten.

Safety

• Complete terminal node reconciliation before task repair, so task read, parse, write, or CAS failures cannot weaken the fail-closed node state.
• Skip unrelated and already-terminal task steps, preserving more specific completion or failure records.
• Keep task records persistent with an unleased CAS write, matching the existing /provisioning/{hostname} lifetime.

Validation

• Python 3.12: 1,449 passed.
• Python 3.13: 1,449 passed.
• Coverage: 92.57% against the 92% floor.
• Interrupted relaunch recovery: 100% statement and branch coverage.
• mypy: 142 source files, no errors.
• ruff check and format, shellcheck, JavaScript syntax checks, and git diff --check: clean.

Live finding

The Phase 3 hard-kill staging test correctly produced a persistent, teardown-only relaunch_failed node but left its provisioning task at starting_llamacpp. This follow-up makes the next gateway startup reconcile that existing record to a failed task with the interrupted step.