CI runners that show their work.

Authoritative lifecycle state, bounded untrusted guest diagnostics, and support-safe identifiers in one authenticated workspace.