fix(jangar): refresh schedule runtime digests

[gregkonush]

Summary

• Refreshes schedule-runner runtime-kit, recovery-case, and required-kit admission stamps from the current allow passport instead of failing long-lived CronJobs when those proof digests rotate.
• Keeps the fail-closed checks on the current passport decision, freshness, and runtime-kit health before creating the AgentRun.
• Updates the Jangar architecture inventory and regression coverage for the generated runner command.

Related Issues

None

Testing

• cd services/jangar && bunx vitest run --config vitest.config.ts src/server/__tests__/supporting-primitives-controller.test.ts -t "builds schedule runner command|refreshes swarm schedule run templates"
• cd services/jangar && bunx vitest run --config vitest.config.ts src/server/__tests__/supporting-primitives-controller.test.ts src/server/__tests__/control-plane-runtime-admission.test.ts src/server/__tests__/control-plane-status.test.ts
• bun run --filter @proompteng/jangar tsc
• bunx oxfmt --check services/jangar/src/server/supporting-primitives-controller.ts services/jangar/src/server/__tests__/supporting-primitives-controller.test.ts
• bun run --cwd services/jangar docs:inventory:check
• bun run --filter @proompteng/jangar lint:oxlint
• git diff --check

Screenshots (if applicable)

N/A

Breaking Changes

None

Checklist

• Testing section documents the exact validation performed (or N/A with justification).
• Screenshots and Breaking Changes sections are handled appropriately (removed or filled in).
• Documentation, release notes, and follow-ups are updated or tracked.