Adopt the boot graph for distributed runner startup

commands/runner_start.go still owns a long manual lifecycle covering containerd, networking, telemetry, the runner, issuer activation, background tasks, and reverse shutdown.

Move those lifecycle concerns into focused boot components using pkg/boot. Keep configuration loading, certificate reconciliation, command policy, signal handling, and the final wait in the CLI layer.

Done when:

• Embedded and external containerd paths publish the same typed capability.
• Telemetry and runner dependencies are explicit.
• The telemetry token source is armed only after the runner publishes its coordinator-backed workload issuer.
• Startup failures prevent dependent components from running.
• Shutdown follows reverse dependency order.
• Targeted tests cover dependency gating and the optional telemetry paths.