chore(agent): add Operations & Debug Runbook to ephemerd-engineer.md

[luthermonson]

Summary

The Ephemerd Engineer agent file was architecture-only. Adds an Operations & Debug Runbook section covering what an agent that just walked into the project needs to know on day 1, captured from one full debugging session that re-derived all of this from scratch.

Sections added:

• Day-1 inventory — `ephemerd status`/`jobs`/`logs`/`doctor`.
• Service control — `ephemerd start|stop|restart|drain` wrappers; `sc.exe` / `systemctl` / `launchctl` documented only as escape hatches.
• Filesystem layout (operational) — install paths, data dir, log paths, control socket, per-job runner/docker socket paths.
• Build & deploy on this host (Windows) — the `mage build:windows` → stop → copy → start loop.
• Auth: App vs PAT precedence — code path in `pkg/github/client.go`, the rule that App auth wins whenever `app_id` is set (so rotating `GITHUB_TOKEN` is a no-op for ephemerd when an App is configured), plus 401 triage.
• Local CI compromise on Windows — the AGENTS.md-documented `miekg/pkcs11` cgo failure and the `GOOS=linux` lint + compile-only test workaround.
• Job lifecycle in the log — what a clean Linux-dispatched vs Windows-native job looks like in `ephemerd.log`, plus how to grep by job id.
• Worktree + commit conventions — short summary of the user's hard rules (per-feature worktrees, backdate commits, no `_ =`, GITHUB_TOKEN for git/gh only).
• CI matrix gotchas — the arm64/macOS gating from PR chore(ci): gate arm64/macOS matrix jobs on repo vars + continue-on-error #75 so the next agent doesn't chase Pending checks.

Stale `Current Branch: feat/windows-support` trailer at the bottom of the file is left as-is — separate cleanup.

Test plan

• File renders as valid Markdown.
• No code changes — runbook content only.
• Spot-check on the next agent invocation that the new section actually lands in their context.