begin-testbox: self-terminate when phone-home is rejected by the backend

[taha-au]

When a testbox is dispatched against one backend environment but the runner is served by the other (staging vs production), the hydrating phone-home reaches a backend that has no record of the testbox. Today that 404 is swallowed by curl -f and treated the same as a network blip: the action continues in degraded mode and the runner idles until the timeout, while the CLI hangs against the dispatching backend. This PR makes the testbox self-terminate on a definitive backend rejection.

How it works:

• The phone-home curl now captures the HTTP status (-w "%{http_code}") and body separately instead of collapsing all failures via -f.
• 4xx responses (404 testbox unknown to this backend, 401 bad token, 409 already shut down, etc.) log the backend URL, status, and response body via ::error:: annotations, remove the state directory, and exit 1. The failed step fails the job, and run-testbox (even with if: always()) exits immediately when the state directory is missing, so the VM terminates right away instead of waiting out the idle timeout.
• 5xx and transport errors (status 000) keep the existing degraded-mode behavior so transient backend or network issues don't kill legitimate testboxes.

This is the defensive complement to the dispatch-time guard in useblacksmith/web (the backend now rejects cross-environment runner labels at warmup). The success path is byte-for-byte unchanged, and yamllint passes. After merge, the v2 tag needs to be moved to pick this up.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is enabled.}

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled. (Staging)}