Wire disk self-heal into K8s-agent local-exec mode

Summary

• Wire disk self-heal into the KubernetesAgent local-exec path. The !UseScriptPods branch (the default — UseScriptPods is false) builds a LocalScriptService that creates the same {tempRoot}/squid-tentacle-{ticketId} workspaces the standalone Tentacle does, but scheduled no background task — so a disk-full agent never auto-reclaimed. Now schedules SelfHealBackgroundTask.ForLocalWorkspaces(backend), byte-identical to TentacleFlavor.cs:50. The flavor-runtime test flips from asserting BackgroundTasks empty to asserting the single SelfHeal task.
• Cover the preview-path role-scoping that shipped untested. A new integration test drives the real IDeploymentService.PreviewDeploymentAsync and proves an unavailable target whose role no enabled step targets is not evaluated by the project's Transient-Deployment-Targets policy (so it neither shows in ExcludedTargets nor blocks). A control case (a step that targets all machines) proves the discriminator genuinely flips on step roles, not on whether the target was loaded.
• Correct a cluster of stale doc comments: the removed SQUID_DEPLOYMENT_TRANSIENT_RESUMABLE escape hatch (transient pause is now unconditional — no opt-out); "open breaker" wrongly listed as a transient-pause cause in two pipeline catches and the TargetCatchClassifier XML doc (CircuitOpenException is excluded from the transient set — it fails fast); and a certificate at-rest customMessage that named AsNoTracking where the provider actually detaches.

No production behavior changes except the self-heal wiring (additive — a background task on the default K8s-agent mode). Everything else is a test addition or comment correction. No interface, signature, or schema changes.

Test plan

• Solution build: 0 errors
• KubernetesAgentFlavorRuntimeTests (4/4) — self-heal now scheduled in local-exec mode
• New IntegrationDeploymentPreviewRoleScoping (2/2) against real Postgres
• Red-green discrimination proof: temporarily dropping the role-scoping (ApplyProjectPolicy(selected, json) over all machines) makes the primary test fail on the exact db-not-excluded assertion ([1, 2] vs [1]) while the all-machines control stays green; restored to confirm green
• DeploymentPipelineRunnerTransientPauseTests (7/7) — comment-only touch, still green