feat: harden lesser-body update recovery

[aron23]

Summary

• preflight lesser-body releases before starting the managed body runner and fail fast on contract gaps
• sanitize persisted CodeBuild command failures and reconcile terminal body runner failures through the active update sweep
• document the canonical portal/operator recovery contract for body preflight, runner, and receipt-ingest failures

Issues

• Closes [Immutable Deploys][M11] Harden lesser-host lesser-body update admission and terminal failure recovery #109
• Closes [Immutable Deploys][M11.1] Add lesser-body release preflight checks before launching managed body updates #111
• Closes [Immutable Deploys][M11.2] Sanitize persisted CodeBuild failure detail for body-update operator fields #112
• Closes [Immutable Deploys][M11.3] Reconcile terminal lesser-body runner failures through the active update sweep #113
• Closes [Immutable Deploys][M11.4] Add regression coverage for body-only failures with command-execution error contexts #114
• Closes [Immutable Deploys][M11.5] Update operator recovery docs and portal messaging for lesser-body update failures #115

Verification

• GOTOOLCHAIN=auto bash gov-infra/verifiers/gov-verify-rubric.sh
• GOTOOLCHAIN=auto go test ./internal/provisionworker -run 'TestPreflightManagedLesserBodyRelease_ValidatesReleaseManifestAndChecksums|TestAdvanceUpdateBodyReleasePreflightFailureFailsBeforeRunnerStarts|TestAdvanceUpdateBodyDeployWait_SanitizesCommandExecutionFailureDetail|TestProcessActiveUpdateSweep_ReconcilesTerminalBodyRunnerFailure|TestUpdateSweepEventBridge_ReconcilesActiveBodyJob' -count=1
• GOTOOLCHAIN=auto go test ./internal/controlplane -run 'TestHandlePortalCreateInstanceUpdateJob_AllowsRetryAfterFailedBodyUpdate' -count=1