v1.5.1 — Watchdog hardening & dead post-job hook removal

Fixed

Runner-shutdown root cause: the watchdog single-poll stop detection conflated systemctl query failures with confirmed service stops. Under heavy load (cargo test, criterion benchmarks), a transient query failure was indistinguishable from runner stopped — triggering immediate DeleteInstance --Force and killing running jobs.

Three-state probe (active / confirmed-inactive / query-failure-unknown): systemctl exit code now captured; self-destruct requires 6 consecutive confirmed-inactive probes (30s window, STOP_CONFIRMATIONS_REQUIRED overridable); active resets, unknown neither increments nor resets.

Pre-destroy forensics dump (best-effort): probe timeline + systemctl/journal tails, 16KB, to log + serial console.

Bootstrap-time validation of STOP_CONFIRMATIONS_REQUIRED from /etc/environment (EXIT trap loud failure).

Removed

Dead post-job hook: ACTIONS_RUNNER_HOOK_POST_JOB never read by runner (inert since initial commit). Leak-blueprint AC-3 pin superseded.

9 new tests (61 total green). Blueprint frozen after 4-round same-family cross review. Teardown latency +15-25s (negligible under per-second billing). Recommended forensics drill: inject load, stop service, verify watchdog log + console capture.