fix(runner): restart when hub identity changes

[ROOOO]

Summary

• persist the runner's hub connection identity in local runner state
• treat API URL, machine ID, and CLI API token changes as runner incompatibilities
• force a new runner instance to take over when that identity changes
• add tests for runner identity compatibility and token hashing

Testing

• bun x vitest run src/runner/runnerIdentity.test.ts
• bun run typecheck

[github-actions]

Findings

• [Major] Identity mismatch not detected when current identity missing — optional checks mean clearing settings/env can keep stale runner bound to old hub/namespace. evidence cli/src/runner/runnerIdentity.ts:29 cli/src/runner/runnerIdentity.ts:33
  Suggested fix:

  if (!current.machineId || state.startedWithMachineId !== current.machineId) {
      return false
  }
  
  if (!current.cliApiTokenHash || state.startedWithCliApiTokenHash !== current.cliApiTokenHash) {
      return false
  }

Summary

• Review mode: initial
• 1 major issue. Identity check allows stale runner when current identity missing.

Testing

• Not run (automation)
• Suggested: add test for missing current machineId/token to lock behavior.

[github-actions]

[MAJOR] Identity mismatch not detected when current identity missing — optional checks mean clearing settings/env can keep stale runner bound to old hub/namespace.

Suggested fix:

if (!current.machineId || state.startedWithMachineId !== current.machineId) {
    return false
}

if (!current.cliApiTokenHash || state.startedWithCliApiTokenHash !== current.cliApiTokenHash) {
    return false
}

[github-actions]

Findings

• None.

Summary

• Review mode: initial. No issues found in changed lines. Residual risk: runner restart behavior on identity mismatch only unit-tested.

Testing

• Not run (automation)