Runner API cert missing IP SANs — `miren app run` and `miren exec` fail

From MIR-903 #20.

When the coordinator proxies run or exec commands to a sandbox on a runner, it connects to the runner's API at 10.128.0.39:8444. The TLS handshake fails because the runner's API cert doesn't include its IP in the SANs:

ERROR: failed to connect to node 10.128.0.39:8444: tls: failed to verify certificate: x509: cannot validate certificate for 10.128.0.39 because it doesn't contain any IP SANs

Same class of fix as MIR-903 #6 (etcd cert SANs) — the runner's API cert needs to include its advertised IP address. The cert is issued during runner join and should include the runner's IP, or be re-issued at startup when the IP is known.