feat(#3139): tell a container that gave up from one stopped on purpose

is_running collapsed every non-active state into false, so a container that
exhausted its bounded restarts read as plain "down" -- indistinguishable
from one an operator stopped deliberately. Bounding the restarts made that
gap sharper: a slow-failing agent used to grind on visibly, now it can stop
quietly.

Adds UnitState + unit_state() beside is_running rather than widening it.
is_running has ~8 call sites and nearly all are reconcile/power logic asking
"is it up? if not, start it" -- a question with two answers. Only the view
builder needs more, and it gets both facts from one systemctl call, since
is-active prints the state when not passed --quiet.

Surfaces as a flat failed flag on ContainerView and AgentStatusRow, matching
the shape those types already document: independent, orthogonally-observed
facts rather than a state machine. serde(default) keeps it order-independent
with the frontend half.

No behaviour change: nothing acts on the flag, per the ruling.

hive-c0re/src/server.rs

@@ -357,6 +357,7 @@ async fn handle_agent_status(coord: &Arc<Coordinator>) -> HostResponse {
         .map(|v| hive_sh4re::container::AgentStatusRow {
             name: v.name,
             running: v.running,
+            failed: v.failed,
             needs_update: v.needs_update,
             needs_login: v.needs_login,
             deployed_sha: v.deployed_sha,