fix(resources): point tenant isolation lease errors to leases.allocate
Summary
Enabling tenant isolation without a lease id fails with an invalid-arguments error that only says a lease id is required. The Limrun guide also never showed how a provider should attach to an instance a harness already owns. normalizeLeaseAdmissionRequest throws INVALID_ARGS with the literal "tenant isolation requires lease id." when normalizeLeaseId returns nothing, and admission uses that check for close and for other commands. The Limrun page described passing an existing instance URL and token, then stopped short of allocating a lease and placing the returned id on the client scope.
The thrown message is now "tenant isolation requires lease id from leases.allocate.", and the admission tests match that wording. The Limrun page adds a provider that calls leases.allocate in acquire, returns lease.leaseId with sessionIsolation set to tenant, and calls leases.release with the same id. The note states that the daemon is started with the instance URL and token, and that neither call creates or deletes the instance.
Fixes #3350
Test plan
npx --no-install vitest run src/sessions/tests/request-admission.test.ts finished with all 15 tests passing.