fix(runtime): load persisted runtime state safely

[vernonstinebaker]

Summary

• parse persisted runtime metadata through a read-only JSON shape before copying owned strings into PersistedRuntime
• avoid returning slices that still alias the JSON parser arena after parsed.deinit()
• add a regression test that loads runtime metadata written in the same JSON form used by the supervisor

Why

Fresh NullHub builds could crash on boot while reconciling persisted managed runtime state. The loader parsed JSON directly into the owned runtime struct and then deinitialized the parser, leaving fields like binary_path and launch_command pointing at freed memory. Boot reconciliation then compared those invalid slices and could segfault before the server started.

Validation

• zig build test -Dbuild-ui=false -Dembed-ui=false
• local smoke: rebuilt NullHub booted cleanly and served /api/status instead of crashing during reconcile-on-boot