Fix event-subscription agents left unassigned after node scale-down (#3341)

[jeremydmiller]

Closes #3341.

Symptom

Under UseWolverineManagedEventSubscriptionDistribution with a sharded Marten store
(MultiTenantedWithShardedDatabases, ~512 shard databases, database-affine assignment),
scaling the pod count down left a subset of shard databases' event-subscription agents
unassigned on the surviving nodes. Those shards' async projections silently stopped
advancing — no error logged, no self-heal — until a rolling restart redistributed them.

Root cause

A node captures its event-subscription capabilities once at startup
(StartLocalAgentProcessingAsync → SupportedAgentsAsync()) and persists them. In a
sharded store whose databases/tenants are provisioned over time, nodes started at
different times hold divergent capability snapshots, so AllNodesHaveSameCapabilities
returns false and DistributeByGroupAffinity takes its capability-matching branch.

A shard database whose agents were running on a now-departed node — re-enumerated into
the grid unassigned via AllKnownAgentsAsync, OriginalNode == null — and whose URIs are
absent from every surviving node's stale snapshot yields:

• group candidates empty (no survivor declares the capability; no member has a surviving OriginalNode), and
• each member's CandidateNodes empty,

so the per-member fallback hit candidate == null and left every member parked — no
AssignAgent command emitted, hence the silence.

The homogeneous path never strands (candidates = all nodes), which is why this only
appeared on clusters whose nodes' snapshots had diverged (aggravated by rapid successive
scaling).

Fix

In the candidates.Count == 0 branch of DistributeByGroupAffinity:

• A group whose members are all unassigned and declared by no node is a stale-snapshot
  artifact — every node can run every shard, and the agents are still enumerated as
  supported by AllKnownAgentsAsync. Assign the whole group to one node (kept together
  to preserve the connection-pool affinity this method exists for) instead of parking it.
• In the mixed-capability case, an unassigned member with no capable node now falls back to
  the least-loaded node overall rather than being silently stranded.

Genuine blue/green placement is unchanged: a real new-version agent is listed by the green
nodes' fresh snapshots, so its candidate set is non-empty and it still lands only on a
capable node.

Tests

• New reproducing unit test a_shard_orphaned_by_a_departed_node_is_reassigned_not_stranded
  — divergent survivor snapshots + a shard orphaned from a departed node; fails on main
  (agent AssignedNode null), passes with the fix, and asserts the shard stays co-located.
• Updated when_no_node_can_host_the_whole_group_members_fall_back_individually to assert
  the previously-parked member is reassigned rather than silently stranded.
• Full CoreTests Runtime.Agents suite green (121 tests).

🤖 Generated with Claude Code