feat(supervise): wsl --shutdown sticks: go idle instead of restarting (#518)

[zcsizmadia]

#518: wsl --shutdown sticks. When the engine's distro stops while the supervisor was watching it run and nobody asked for a stop, the engine is left down and marked idle. The next docker command wakes it through the existing demand path. A dockerd crash, where the distro keeps running, is still restarted.## The rule, and why it's about a change and not a stateAn audit of every place Skrog itself stops the engine found that "distro stopped + desired running" is the normal state in front of a start:- skrog start and skrog restart- logon autostart after a reboot- restart --supervisor- a daemon.json bounce- a snapshot restore under a supervisorA rule that checked the distro on every tick would strand all of those. So:- sawUp is true only while this process has watched the engine run with desired running.- It's cleared by: - a stop request, in either desired-stopped branch - the supervisor's own idle stop - a maintenance hold - deciding a down engine was a crash- On the first down observation with sawUp set, the supervisor asks the new optional DistroProber whether the distro is running. The answer is latched, and it's asked once. - Distro stopped: write EngineIdle and leave the engine down. skrog status reports idle, and Demand wakes it. - Distro running, or the probe fails: restart, as before. "Cannot tell" is a crash, because guessing "stopped on purpose" wrongly would leave a crashed engine down.- An Engine without DistroProber behaves exactly as before. All existing supervisor tests use such an engine and are unchanged.Provisioner.DistroRunning answers from the WSL listing only, never an exec (an exec would boot the distro, #82). An unregistered distro is an error, not "stopped".## snapshot saveThe snapshot package says wsl --export terminates the distro and "the supervisor brings it back". I haven't re-verified that. The export now runs under a maintenance hold (the mechanism engine upgrade uses), so the engine comes back afterwards either way. The hold also stops the supervisor probing, and so booting, the distro mid-export.## Behaviour change to knowContainers with a restart policy used to come back after a wsl --shutdown by themselves. They now wait for the next docker command. Whether a sleep/resume ever stops the distro isn't measured; if it does, the same applies. This is in the CHANGELOG and the Run comment.## Testsinternal/supervise/outsidestop_test.go covers:- an outside shutdown leaves the engine down and idle, and Demand starts it- a daemon crash with the distro up is restarted- a fresh supervisor starts a stopped distro- stop-then-start is a start- a stop during a hold is restarted- unknown distro state restarts- a crash in backoff isn't later read as a shutdown- an engine without the probe still restartsinternal/provision/distrorunning_test.go: listing-only, and unknown or unregistered is an error.Mutation-checked, each failing at least one test:- The naive rule (no sawUp gate) fails four tests: fresh supervisor, stop-then-start, hold, and backoff latch.- No latch- Idle not written to the file- A hold keeping sawUp- A requested stop keeping sawUp- An unknown distro state read as stopped- An unregistered distro read as stoppedDocs: skrog supervise and skrog proxy help, README, docs/auto-logon-runner.md and docs/cli-json.md (idle now also means this) no longer promise recovery from wsl --shutdown. CHANGELOG entry under Changed. lint.ps1, the drift checks (regenerated), build-docs.ps1 -Strict and check-links.ps1 pass.## Live acceptance (from #518, not yet run)- [x] Supervisor running, engine up, wsl --shutdown → skrog-engine still stopped a minute later (on main: running again within seconds), and skrog status says idle.- [x] The next docker ps wakes it and succeeds.- [x] Killing dockerd inside the distro still restarts it.- [x] skrog restart, skrog config set engine.<key>, snapshot save and snapshot restore each bring the engine back.Closes #518

Live acceptance, run 2026-10-05 on WSL 3.0.1

This branch's build, stacked on #521 (idle-timeout 5m), supervising the maintainer's real install:

• wsl --shutdown: the engine stayed down, skrog status said idle, and the distro was Stopped for 80 s and more.
• The next docker ps woke it and succeeded in 6 s.
• kill -9 of dockerd (pid 30), with the distro up: restarted as pid 392 within 5 s.
• skrog restart, config set engine.max-concurrent-downloads 3 and clearing it again (two daemon.json bounces), snapshot save (7.4 GiB) and snapshot restore: each left the engine running, with docker answering. 24 images before and after the restore.

This also fixes a 0.8.0 bug, seen live today: after snapshot save under the 0.8.0 supervisor, the engine stayed stopped with desired running and the distro running, and docker failed until skrog start. With this branch, snapshot save brought the engine back. The CHANGELOG entry, which claimed the engine "comes back afterwards as it did", is corrected.

Rebased onto main after #521 and #526 (CHANGELOG only); the full suite passes.