Manual validation of distributed runners on Toys cluster

Hands-on validation of distributed runners on the Toys cluster. This is the "bang on things" pass to build confidence before redeploying to Garden.

Prerequisites

The following issues were discovered during the initial Garden dogfooding (MIR-890) and need to be resolved first:

• MIR-920 — Fix runner API cert IP SANs (app run/exec broken on runner sandboxes)
• MIR-902 — miren runner install command for clean provisioning
• MIR-919 — Human-readable runner names
• MIR-917 — miren runner remove to clean up stale nodes
• MIR-918 — Runner version entity updates on restart

Testing checklist

• Fresh runner provisioning via miren runner install + miren runner join
• App deploy schedules sandboxes across coordinator and runner
• miren app run and miren exec work on runner-hosted sandboxes
• miren sandbox list shows runner names
• Runner restart preserves version info
• Stale runner cleanup with miren runner remove
• Deploy rolls sandboxes correctly across nodes
• Network overlay (flannel) routes traffic between nodes

Environment

• Cluster: Toys (gcloud compute ssh miren-toys --project=miren-development)
• Local CLI connected to Toys for client-side testing