Support suspending a PAUSED actor without waking it

[HavenXia]

From #119,

If an actor remains paused for an extended period and --timer is provided, the system escalates it to a SUSPENDED state to ensure data safety and free up local node storage.

We need to support the SuspendActor on a PAUSED actor, overall it should be one atelet call that uploads the existing local files, then the api records the ActorSnapshot, clears LocalSnapshotInfo and the node pin, and sets SUSPENDED.

This is a critical path for both Actor Lifecycle(#119) and System Upgrade(#473)

[dberkov]

Proposed implementation plan, split into 5 PRs so work can proceed in parallel (PRs 1–3 are mutually independent; only PR 5 turns the feature on).

Design summary

Keep the existing 5-step SuspendActor workflow and branch inside the steps on a FromPaused discriminator computed at load time: status == PAUSED, or status == SUSPENDING && WorkerAssignment == nil && LocalSnapshotInfo != nil (the nil-assignment conjunct is required because resume never clears LocalSnapshotInfo, so a RUNNING actor resumed from pause still carries a stale one).

On the node, a new atelet RPC UploadPausedCheckpoint (not a new CheckpointType — the Checkpoint handler drives a live ateom, which a paused actor doesn't have) reads the local pause snapshot's manifest.json, uploads the files via the same ategcs primitives as uploadExternalCheckpoint (manifest last, as commit marker), then prunes the local checkpoint. ateapi dials atelet by node name (LocalSnapshotInfo.NodeVmsWithLocalSnapshots) via a new DialForNode, since a paused actor has no worker pod.

Scope handling — the upload honors the commit scope (OnCommit), like a normal suspend:

Captured (OnPause)	Desired (OnCommit)	Behavior
FULL	FULL	plain upload
DATA	DATA	plain upload
FULL	DATA	microVM: extract durable-disk files; gVisor: Unimplemented until split-checkpoint runsc (#790)
DATA	FULL	rejected (FailedPrecondition) — cannot fabricate memory; covers the golden-atespace corner

The captured scope is recorded in the snapshot's own manifest.json (new scope field written at Checkpoint — authoritative at upload time) plus a control-plane copy in LocalSnapshotInfo.content_scope for early rejection before the actor leaves PAUSED.

Failure semantics: dial/upload failures are retryable (actor stays SUSPENDING, client-driven forward recovery; local files intact, deterministic object names). Only definitive data loss (local dir gone AND no remote manifest) crashes the actor (LOCAL_SNAPSHOT_GONE). Idempotent retry after a successful upload is detected via the remote manifest probe.

PR breakdown

PR 1 ──(soft)──> PR 4 ──┐
PR 2 ───────────────────┼──> PR 5
PR 3 ───────────────────┘

PR 1 — Record scope in the snapshot manifest (atelet only)
Add Scope to sandboxAssetsRecord; Checkpoint writes it for local and external manifests. Tiny, no API change, no dependencies.

PR 2 — LocalSnapshotInfo.content_scope (control plane only)
ateapipb proto + regen; FinalizePausedStep records the OnPause scope. No dependencies.

PR 3 — Behavior-preserving refactors (control plane only)
Dialer: extract dialAteletOnNode, add DialForNode + ErrNoAteletOnNode. FinalizeSuspendedStep: hoist finalization (ActorSnapshot creation + SUSPENDED flip) out of the if assignment != nil block — latent bug: with a nil assignment the workflow would "succeed" leaving the actor SUSPENDING forever. No dependencies.

PR 4 — atelet UploadPausedCheckpoint RPC (dead code until PR 5)
ateletpb proto (snapshot_prefix, snapshot_uri_prefix, desired_scope, spec) + regen; handler with manifest read, captured-scope resolution (manifest scope, legacy inference fallback), idempotency probe, upload, prune, scope-conversion gate (gVisor FULL→DATA Unimplemented, TODO #790), microVM durable-disk extraction; ReasonLocalSnapshotGone. Soft-depends on PR 1.

PR 5 — Enable suspend from PAUSED (the feature)
FromPaused discriminator, MarkSuspendingStep accepts PAUSED + early scope rejections, CallAteletSuspendStep paused branch via DialForNode, functional tests. Depends on PRs 1–4.

Deploy-order note: atelets need PR 4 rolled out before PR 5's ateapi reaches production — an old atelet answers the new RPC with Unimplemented (retryable, but the actor sits in SUSPENDING until the node upgrades).

Deferred follow-ups: gVisor FULL→DATA extraction after #790; janitor/retry budget for a SUSPENDING actor whose snapshot node is permanently gone; updating the docs/architecture.md state diagram (predates pause).