PR 4: privatize unsafe lifecycle transition paths

[bill-ph]

Summary

PR 4 of the worker-lifecycle redesign. Net: +163/-434 LOC across 8 files — mostly deletions, no new behavior.

PR 3 introduced the typed lifecycle service but left every migrated call site with a `if lifecycle == nil { legacy }` fallback so each migration commit was independently revertible. With PR 3 merged those fallbacks are dead in production. This PR removes them and narrows the public store interface so the typed seam is the obvious path.

What lands in this PR

1. Delete legacy `lifecycle == nil` fallback branches

• `k8s_pool.go::retireClaimedWorker`: the direct `MarkWorkerTerminalIfCurrent` + `deleteRetiredRuntimeWorker` branch is gone; `lifecycle.RetireFromSnapshot` is the only path.
• `k8s_pool.go::ShutdownAll`: the direct `MarkWorkerDraining` / `RetireDrainingWorker` legacy branches are gone; the lease-based `Drain` → pod delete → `RetireDrained` chain is the only path.
• `shared_worker_activator.go::RefreshWorkerCredentials`: the direct `BumpWorkerEpoch` branch is gone; `lifecycle.RefreshLease` is the only path. Returns an explicit error if the activator is constructed without a lifecycle.
• `janitor.go`: orphan, stuck-spawning/activating, and hot-idle reapers all flow through the lifecycle. The stuck-worker path migrates from the now-deleted `retireWorker` lambda to `lifecycle.RetireFromSnapshot`.

2. Delete unused janitor lambda plumbing

All four janitor lambdas (`retireWorker`, `retireOrphanWorker`, `retireLocalWorker`, `deleteRetiredWorker`) and their corresponding `multitenant.go` wires are gone. The `retireRuntimeWorker` helper that wrapped them is gone. The `controlPlaneExpiryStore` interface sheds `ListOrphanedWorkers`, `ListStuckWorkers`, `ListExpiredHotIdleWorkers`, `RetireHotIdleWorker` — the snapshot-typed variants are the only callers now.

3. Narrow `RuntimeWorkerStore` interface

Three worker-id-only CAS methods are moved off the public interface. They stay on `*configstore.ConfigStore` and are extracted via type assertion to the package-private `workerLifecycleStore` when wiring the lifecycle service:

• `MarkWorkerDraining(workerID, cpID, epoch)`
• `RetireDrainingWorker(workerID, cpID, epoch, reason)`
• `BumpWorkerEpoch(workerID, cpID, epoch)`

A caller with only a `RuntimeWorkerStore` reference cannot reach these methods directly — they have to go through `WorkerLifecycle`. That's the PR 4 hardening goal stated in the roadmap.

`MarkWorkerLostIfCurrentLease` stays on `RuntimeWorkerStore` because the health-checker (`markWorkerLostForHealthLease`) still calls it directly; PR 5 will migrate that path to `lifecycle.MarkLostFromLease`.

`RetireIdleWorker` is removed entirely — it had no callers anywhere in the tree.

4. `K8sWorkerPool.ensureLifecycle()`

Lazy initialization for tests that bypass `newK8sWorkerPool` and assign `pool.runtimeStore` directly. Production always wires the lifecycle eagerly in the constructor. The 42 existing tests that pattern `pool.runtimeStore = store` continue to work unchanged; the lifecycle is created on first lifecycle-using call.

5. Test cleanup

• `TestControlPlaneJanitorDeletesHotIdlePodAfterStoreRetire`: deleted, covered by the lifecycle-path test.
• `TestControlPlaneJanitorSkipsHotIdlePodDeleteAfterStoreMiss`: rewritten to assert on lifecycle outcome.
• `TestControlPlaneJanitorRunRetiresOrphanedAndStuckWorkers` and `TestControlPlaneJanitorRunOnceContinuesAfterExpireError`: migrated from `retireWorker` callback assertions to lifecycle-store assertions.
• The lifecycle-path tests added in PR 3 (`TestControlPlaneJanitorHotIdleGoesThroughLifecycleWhenWired`, `TestControlPlaneJanitorOrphanGoesThroughLifecycleWhenWired`) shed the now-impossible "legacy lambda must not fire" assertions; the fields they referenced are gone.
• `captureRuntimeWorkerStore.RetireIdleWorker` mock impl and unused `janitorObservedWorkerRecordMatchesCurrent` helper deleted.

What stays

• `MarkWorkerLostIfCurrentLease` on the public interface (health-check path migration → PR 5).
• The configstore `List*` legacy methods (`ListOrphanedWorkers`, etc.) — postgres integration tests in `tests/configstore/` exercise them directly, and the snapshot-typed wrappers are thin layers over them.

Testing

• `go build -tags kubernetes ./...` clean
• `go vet -tags kubernetes ./controlplane/...` clean
• `go test ./controlplane/...` and `go test -tags kubernetes ./controlplane/...` — all 5 packages pass

Out of scope

• `BumpWorkerEpoch ↔ ShutdownAll` in-memory-epoch race → PR 5
• Health-checker migration to `lifecycle.MarkLostFromLease` → PR 5 (the activator-style legacy code path it would simplify is fundamentally similar to the one PR 3 left for that reason)
• Per-image / fine-grained CAS-miss classification metrics → PR 6

⚠️ Two commits in this stack are unsigned because the Secretive agent has been refusing prompts during the autonomous session. Easy fix before merge: `git rebase --exec 'git commit --amend --no-edit -S' origin/main`, or rely on squash-merge.

🤖 Generated with Claude Code