Say what keeps a checkpoint and settle two flaky waits

[ppXD]

Summary

• Name both keepers of a run's session-checkpoint columns — the reconciler's abandon and its spool recovery, which land through the same terminal CAS (AgentRunReconcilerService.CasTerminalAsync) — in the cancel and resumable-lookup comments of AgentRunService.cs and in ArtifactRetentionPolicy.cs, whose 162-character doc line is also re-wrapped to the file's width.
• Behaviour change (goal text every retry lane emits): AgentRetryContinuity.HonestNoContinuityHint now ends "(your prior attempt pushed no branch of its own)" instead of "(no pushed branch was found to continue from)", which contradicted a dependent supervisor unit's "Continue from this branch" handoff in the same goal. LostHostPreamble now says "the machine or the process running your previous attempt was lost mid-run", because the reconciler abandons the same way for ProcessConfirmedDead and for a lapsed lease whose orphan it kills; LostHostPublishedBranchHint says the unpublished remainder "was lost with that attempt" instead of "died with the machine".
• SupervisorTurnService.RunGradingHeartbeatLoopAsync takes its TimeProvider as a required parameter (the three call sites pass TimeProvider.System; no constructor changes), matching HeartbeatLoop.RunAsync since Run every heartbeat on the clock its caller passed #2005. SupervisorGradingHeartbeatTests drive a FakeTimeProvider and assert exactly one heartbeat per elapsed interval. The cancel test records the loop's outcome directly: Should.NotThrowAsync passes a canceled task, so it could never catch the escaping OperationCanceledException the test is named for.
• Production fix: LoopbackModelCredentialBroker.Install calls AcceptAsync directly instead of through Task.Run, so the loop's first accept wait is registered before Install returns. A close that raced that registration was never delivered by the managed HttpListener, leaving the loop waiting forever with the lease still claimed — the cause of the A_lease_whose_listener_died_stops_being_claimed flake (open-then-break against the real broker: 23 of 1500 leases stuck before, 0 of 1500 after). The test now wakes on the drop's warning, its last effect, instead of polling HasLease, and the raw NUL byte in the file's ThisHost constant is written as \0 so grep stops skipping the file as binary.

Test plan

• dotnet build backend/CodeSpace.sln: 0 errors
• Unit: full suite, 10931 passed, 0 failed, 1 skipped
• Integration: AgentNodeFlowTests, SupervisorRetryWorldStateFlowTests, AgentRunSessionCheckpointFlowTests, SupervisorPreClaimCrashRecoveryFlowTests (57/57); AgentRunExecutorTests including the credential-broker partial (109/109); AgentRunReattachFlowTests (13/13); SupervisorAcceptanceGradeFlowTests, SupervisorAcceptanceFoldFlowTests, SupervisorUnitAcceptanceFoldFlowTests (116/116)
• Mutations: a heartbeat that ignores the handed clock, stops after one tick, lets the cancel escape, or ignores the cancel mid-sleep turns SupervisorGradingHeartbeatTests red; a drop that keeps the table entry, a silent drop, or an accept loop that swallows the failure turns A_lease_whose_listener_died_stops_being_claimed red
• Sandbox: ModelCredentialBrokerNetnsE2ETests degrade-skips on macOS; the privileged Linux job is authoritative