fix(supervise): skrog start right after wsl --shutdown is a start (#530)

[zcsizmadia]

skrog start now writes a start-request token (start-request in the state dir, a fresh value on every call) along with desired state and the idle marker. The supervisor watches the token as part of its intent poke and consumes it on every reconcile. When a start request it hasn't seen yet meets a down engine, that's a start:

• sawUp is cleared, so the wsl --shutdown should stick: go idle instead of restarting the engine #518 outside-stop verdict doesn't fire.
• If the request landed during the distro probe and the idle marker got written after start cleared it, the marker is cleared again, so the next tick starts the engine. The verdict also checks for a request again right after the probe, which saves that tick in the common case.

A request consumed while the engine is running is spent at that point. A later wsl --shutdown still sticks, as #518 intends.

Verification

New tests in internal/supervise/outsidestop_test.go:

• TestStartRightAfterAnOutsideShutdownIsAStart reproduces the nightly failure. Before the fix, with the exact writes the old skrog start made, it failed with started 0 times ..., want 1 and engine recorded as idle.
• TestStartDuringTheDistroProbeIsAStart covers a start that arrives mid-probe.
• TestStartWhileRunningDoesNotOverrideALaterShutdown checks that a stale request doesn't undo a later shutdown.

Negative controls, run locally with each piece reverted in turn:

• No token written: the first two tests fail.
• No marker clear and no post-probe recheck: the mid-probe test fails. Reverting only the recheck still passes, as expected, because the marker clear covers it one tick later.
• Requests consumed only when the engine is down: the stale-request test fails.

scripts/lint.ps1: shellcheck, gofmt, vet, build and tests pass locally. govulncheck fails locally on Go 1.27.1 standard-library advisories in internal/bundle and internal/upgrade, which this change doesn't touch.

The unit tests can't hit the real timing. The e2e workflow will be dispatched on this branch more than once before merge, since a single green run of an intermittent failure doesn't prove much.

Closes #530.