feat(#2290): converge unification cleanup — pull preamble into lifecycle

Collapse the scattered ensure_agent_runtime_dir calls into the lifecycle
functions themselves so callers have a single responsibility:

- lifecycle::spawn: calls ensure_agent_runtime_dir before write_dropins.
  Callers (handle_spawn, ensure_root_agent) no longer need a separate
  preamble step.

- lifecycle::rebuild_no_meta spawn path: calls ensure_agent_runtime_dir
  before write_dropins. apply_commit / merge_config_pr flows no longer
  need a manual ensure_agent_runtime_dir.

- run_create (job-queue): drops ensure_agent_runtime_dir + register_agent.
  The tail Reconcile's converge_start_preamble handles the runtime dir
  and mcp_sockets::spawn_poll handles the listener. Create stays purely
  'provision + create', not 'create + start'.

- handle_spawn (server.rs): drops manual preamble; lifecycle::spawn owns it.
  Drops unneeded unregister_agent on failure (supervisor handles listener).

- ensure_root_agent (auto_update.rs): drops manual ensure_agent_runtime_dir.

- actions.rs apply_commit / merge_config_pr: drop manual
  ensure_agent_runtime_dir; rebuild_no_meta's spawn path handles it.

Result: ensure_agent_runtime_dir lives in exactly two places —
lifecycle::spawn (direct spawn) and converge_start_preamble (start/reconcile
path). All other callers are clean call sites.

hive-c0re/src/job_queue/exec.rs

@@ -181,11 +181,6 @@ async fn run_swap(coord: &Arc<Coordinator>, claim: &Claim, ctx: &Ctx<'_>) -> Res
 /// build+create — no prebuild needed).
 async fn run_create(coord: &Arc<Coordinator>, claim: &Claim, ctx: &Ctx<'_>) -> Result<NodeOutput> {
     let name = &claim.agent;
-    // First-spawn: create the bind-mount source dir (tmpfs — empty after
-    // reboot). Register the MCP listener eagerly so it's ready when the
-    // tail Reconcile starts the container and the harness connects.
-    crate::lifecycle::ensure_agent_runtime_dir(name)?;
-    coord.register_agent(name)?;
     let agent_dir = Coordinator::agent_dir(name);
     let hive = coord.hive_env();
     let paths = Coordinator::agent_paths(name, agent_dir);
@@ -194,6 +189,9 @@ async fn run_create(coord: &Arc<Coordinator>, claim: &Claim, ctx: &Ctx<'_>) -> R
     // (sync_agents commit) before `nixos-container create` — hold the
     // deploy-window gate so that commit can't land inside another
     // node's staged deploy window.
+    // Runtime dir creation and MCP listener registration are deferred to
+    // the tail Reconcile's converge_start_preamble / mcp_sockets supervisor
+    // so this node stays purely "provision + create", not "create + start".
     let _window = crate::meta::exclusive().await;
     crate::lifecycle::create_container(name, &hive, &paths).await?;
     Ok(NodeOutput::default())