Fix runtime worker claim race

[EDsCODE]

Summary

• keep org-specific spawned workers out of the public idle pool until reservation finishes
• retry stale runtime-store claims instead of retiring the currently-owned worker
• make duplicate same-owner reserved/activating claims idempotent

Tests

• go test -tags kubernetes ./controlplane
• go test ./controlplane