fix(#2289): wire ci-runner registration failures to dashboard warning banner

Both warn!-and-forget sites in ensure_ci_runner_registered() now also
call set_boot_warning():

- fetch_registration_token failure → crit banner (forge unreachable or
  API error; runner stays with stale/absent creds)
- hive-priv register_ci_runner failure → crit banner (EROFS or priv
  socket error; runner token not written)

Both are only ever invoked from ensure_all() at hive-c0re startup (no
periodic retry), so set_boot_warning() is the right API: the banner
persists until the next c0re restart that re-runs the step, which is
exactly when a config/environment fix (e.g. the ReadWritePaths EROFS
fix from 64075107) would take effect.

Journal warn! lines are kept alongside the banner (belt-and-suspenders).

Remaining in scope for #2289: sync_agent() warn! sites (called from
both startup and rebuild paths — needs set_warning RAII or explicit
return value to enable later success to clear the banner; left for a
follow-up).

hive-c0re/src/forge/ci_runner.rs

@@ -49,11 +49,23 @@ pub(super) async fn ensure_ci_runner_registered(core_token: &str) {
         Ok(token) => {
             if let Err(e) = crate::priv_client::register_ci_runner(&token).await {
                 tracing::warn!(error = ?e, "ci runner: hive-priv register_ci_runner failed");
+                crate::stats::warnings::set_boot_warning(
+                    "ci_runner_register",
+                    "crit",
+                    format!("ci runner: hive-priv register_ci_runner failed: {e}"),
+                );
             } else {
                 tracing::info!("ci runner: registered hive-ci runner with a fresh token");
             }
         }
-        Err(e) => tracing::warn!(error = ?e, "ci runner: fetch registration token failed"),
+        Err(e) => {
+            tracing::warn!(error = ?e, "ci runner: fetch registration token failed");
+            crate::stats::warnings::set_boot_warning(
+                "ci_runner_fetch_token",
+                "crit",
+                format!("ci runner: fetch registration token failed: {e}"),
+            );
+        }
     }
 }