#4275 feat(limrun): map boot and shutdown to instance leases

Summary

Limrun owns instance lifetime, so powering off its guest would leave the instance allocated. This 45-file change maps boot to create/reuse and shutdown to lease release. Created instances are deleted; attachments detach without deleting the externally owned instance. Explicit shutdown releases retained leases. Failed cleanup preserves its session, lease, and diagnostic for retry.

Unallocated provider requests fail in shared inventory before local selection, including SDK open and session-less boot. Headless boot preserves allocation guidance. Stored-lease clearing follows declared connection policy. Scope includes session-aware recovery hints and preserving local finalizer/IME ordering from #3318. CLI/MCP descriptions explain deletion and data loss.

Examples: agent-device boot, agent-device shutdown, agent-device close --shutdown. Merged #4268 covers Android text/performance.

Validation

Rebased onto df8391a63. At 378f995d1e8ed21854911293986ad718a1c27ec8, pnpm check:affected --run --head HEAD passed with exactCommit: true. Receipt, focused tests, base comparisons, independent review, and live results. Headless/inventory regressions fail on b32b21848 and pass here.

Fresh live runs cover owned Android/iOS lifecycle, native snapshots, and unallocated SDK refusals while a local simulator stays booted. Earlier evidence covers attachments, retained leases, and local shutdown. All resources were cleaned up. GitHub-owned coverage/native/device checks remain CI obligations.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}