Admit independent service SVID roles on Gateway receivers - #16364

Explicit `ResumeEnvironment` no longer reserves the shared wake budget,
for direct Pod-bound and service-SVID operator callers and Identity
resume grants. Automatic Dispatcher `RequestWake` alone reserves
`ReserveWakeAttempt`; authorization, operator-stop handling, generation
tokens and optimistic locking retain their existing behavior. This
implements the operator’s 2026-11-14 07:41 UTC decision, “No budget for
explicit resume,” recorded in [plan PR
#16368](#16368) at
`0675c37082`.

`TestExplicitResumeDoesNotReserveWakeBudget` exercises both caller paths
with exhausted and unavailable budget backends and requires successful
resume with zero reservations.
`TestEnvironmentServiceServiceRolesStayMethodScoped` checks a real mTLS
service operator resume succeeds with zero reservations; the
foreign-target Identity grant test also checks zero reservations.
Conflict and stale-token tests retain their coverage, with concurrent
requests synchronized at the Kubernetes patch boundary rather than
inside the budget fake.

Automatic wakes remain bounded:
`TestAutomaticWakeSharesPolicyBudgetAndReportsRetryFacts` still requires
rate limiting with retry facts when exhausted and refusal when the
backend is unavailable; Dispatcher’s
`TestMixedVersionWakeWritersShareCapAndGenerationDedup` and Store
integration tests cover durable shared reservations. Lifecycle SPEC,
README and interface comments now distinguish the two paths.

Validation:

- Changed-file pre-commit and all commit hooks passed (gofumpt applied
formatting first).
- `bbr test
//agentplane/runner_gateway/environments/lifecycle:lifecycle_test
//agentplane/runner_gateway/environments:environments_test
//agentplane/runner_gateway/dispatcher:store_integration_test
//agentplane/system_tests/suites:test_dispatcher --test_output=errors` —
all 4 passed
([45ead54e](https://app.buildbuddy.io/invocation/45ead54e-7d63-4603-837d-3ad3e388ce46));
3 executed, Dispatcher storage integration cached. The full Dispatcher
system suite passed in 228.3s and covers queue, automatic wake, delivery
and replica behavior. Full current-head GitHub CI pending.

Rollout: deploy/pin the Gateway behavior. No settings, manifests, schema
or wire contract changes, so no image-before-config ordering applies.
Independent of the identity-change fence PR #16373. Rollback: revert the
Gateway image pin; explicit resume again uses the existing budget.
Retain current Sandbox generations and budget rows. After Flux applies
the pin, check explicit resume and automatic queued wake, including
normal delivery and wake-budget retry facts.

Deliberately leaves out automatic-wake policy or limit changes,
settings/manifests, storage ownership or service extraction, Runtime
Identity defense, caller-authentication changes, and any new
cross-component call.

Rebased onto `9a955bd3` after Gateway service SVID admission #16364,
preserving its service roles and authentication behavior. Post-rebase
focused validation
([0fd41c23](https://app.buildbuddy.io/invocation/0fd41c23-f01e-45ce-9115-6f0652352163))
passed lifecycle, Dispatcher storage (cached), and the full Dispatcher
system suite (231.9s), but found the newly landed mTLS service-operator
test still asserting an explicit budget reservation. Commit `d63bccb9`
changes that assertion to zero reservations while retaining its
method-scoped authorization and desired-state checks. The corrected `bbr
test //agentplane/runner_gateway/environments:environments_test
--test_output=errors` executed and passed
([3fcea46b](https://app.buildbuddy.io/invocation/3fcea46b-f7c8-40f4-bb2d-b4f8d5f0c93a)).
Changed-file pre-commit and commit hooks passed. Full current-head CI
pending.

Latest rebase: head `9f01bc92f168218eb361383b6dd6c58b81224226` is based
on `a68e0de510d6ea10184705ab453a69259cb85801`, including service-SVID
admission and the system-test root-key renewal correction #16377. The
rebase was conflict-free; range-diff showed unchanged patches, and it
was published with `--force-with-lease`. GitHub confirms this head.
Current-head pre-commit, Nix and artifact/import checks passed; Bazel
and visual review are running, with no reported failures as of
2026-11-14 08:29 UTC. The focused RBE results above remain prior-base
validation. Fresh `origin/devel` is
`6e591f383864ab47d7a9370abb4bd6637f0faee3`; its two additional commits
change image pins and a Dispatcher documentation note, and GitHub
reports this PR mergeable.

## Questions for Claude

None.

---------

Co-authored-by: agentydragon-agent <260791330+agentydragon-agent@users.noreply.github.com>