Dogfood distributed runners on Toys cluster

Initial dogfooding pass for distributed runners. Originally targeted Garden, where we hit a wave of issues. Those are now tracked individually and the remaining manual validation has moved to MIR-965 (Toys cluster).

Issues discovered during Garden dogfooding

• MIR-920 — Runner API cert missing IP SANs
• MIR-902 — miren runner install command
• MIR-919 — Human-readable runner names
• MIR-917 — miren runner remove command
• MIR-918 — Runner version entity updates on restart
• MIR-894 — Runner join session ID error
• MIR-896 — Runner expects system containerd
• MIR-903 — Last mile fixes for runner startup
• MIR-921 — (referenced in original)

Outcome

Backed out of Garden, redeployed on Toys. Manual validation continues in MIR-965.