feat(agent): let the daemon re-authenticate an enrolled device (#175)

[gen16k]

Why

waired init on a host that already has an identity was the last input that
selected the standalone enrollment implementation. The daemon could not renew
credentials for a device it had already enrolled — Start returned its
idempotent no-op — so re-auth had nowhere else to go.

This is the behaviour half of closing #175. The deletion follows in its own PR.

The control plane needed nothing

EnrollDevice already matches an existing Device on the machine key and
renews the row (renewDeviceTx, "#115 Phase C"), and the renewal path is
exempt from the per-network device cap. setup.Enroll loads the existing
machine key rather than generating one, so it falls straight into that path.

So: agent wiring only. No proto change, no waired-side PR, no CP deploy to
wait on.

What changed

File	Change
internal/management/login.go	LoginStartRequest.Reauth
cmd/waired-agent/login.go	Start skips the already-active short-circuit when asked; run rebuilds the session instead of publishing a second one
cmd/waired-agent/main.go	the node-key rotator's teardown-then-activate becomes one rebuildSession function, shared with the login controller under one mutex
cmd/waired/init_route_daemon.go	routeLocal and every fact that used to steer to it
cmd/waired/login_client.go	passes reauth; names the version-skew failure
cmd/waired/init_benchmark.go	disabled / stopped end the benchmark wait

chooseEnrollRoute now decides one thing: is the agent there. Its table
test is the full input space rather than a sample of it — if a later change
reintroduces an input that steers elsewhere, there is nowhere for it to steer.

Two defects fixed on the way

--auth-key on an already-enrolled host printed a successful sign-in for a
run that renewed nothing. It took routeDaemon and hit the daemon's no-op.
Now it re-authenticates. Pinned by a test.

waitForBenchmark waited ten minutes for a model that was never coming.
It read disabled and stopped as "engine is up, a download must be in
flight" and sat on "Waiting for the model to finish downloading…" until the
deadline before reporting it had given up — on a host with local inference
switched off. waitForBundledModel has always treated those two states as
terminal (init_pull.go:97); now both do.

Measured, not estimated: install test (linux) on this branch's parent took
11m55s against 1m45s on main before the harness migration, and the
whole delta is one ten-minute wait per leg, three legs, every PR. It became
CI's problem when #290 migrated the harness to the daemon path; it has been a
real user's problem on any gateway-only host for longer than that.

waitForBenchmark is shared with waired runtimes benchmark, so that command
stops hanging on an inference-off host too.

Version skew

An agent predating reauth ignores the field (handleLoginStart decodes
leniently) and answers with the no-op status: active, no session id. The CLI
names that — "the background service is too old to renew that sign-in" —
rather than reporting the protocol symptom, or success.

What is left behind on purpose

The code behind the removed route is unreachable from this commit but still
present, marked as such. Deleting it here would have buried a ~250-line
behaviour change under ~3,300 lines of deletion.

Verification

• gofmt -l . / go vet ./... / golangci-lint run (0 issues) /
  go test ./... -timeout 12m
• go build -tags prod ./..., go vet -tags prod ./...,
  go test -tags prod ./internal/buildflag/...
• make verify-cross
• bash scripts/ci/harness-failure-strings-guard.sh,
  python3 scripts/ci/decision-log-guard.py
• node scripts/i18n-sync.mjs --check — 32 pairs in sync

Not verified locally: a real re-auth against a live control plane. The
3-OS installtest legs exercise the enrollment path itself; the re-auth branch
is covered by the daemon-side and CLI-side tests, and by the CP-side evidence
above that renewDeviceTx is the path an existing machine key takes.

Refs #175

[github-actions]

📘 Docs preview for this PR: https://waired-docs--pr-296-a3zow9ff.web.app

Rebuilt on each push; the preview channel auto-expires in 7 days.