fix(observability): accept authenticated pre-webhook start

[rldyourmnd]

Closes #206

Natural evidence behind this refinement

The first post-#207 short job (setup-systems run 33001825473, job pins) reached the authenticated job-start hook before GARM delivered JobStarted. Waiting for a running row is therefore circular: the hook blocks before job steps while the lifecycle event may arrive later.

Change

• use the verified one-job claim pool plus exact repository and JobAvailable job identity
• promote exactly one assigned/acquiring/acquired intent to running from the authenticated hook
• refuse zero or multiple exact candidates
• preserve the existing exact-runner idempotent path

Verification

• make verify
• repeated queue/cachebroker tests
• HTTP claim integration now starts from an acquired intent with no runner identity