#21559 fix(staging): finish Huge Blue runtime composition and attach flow

Problem

The merged Huge Blue staging snapshot still had two production blockers: legacy token foreign keys on existing staging branches and a staging harness that could not compose the current runtime or return a usable short-lived attach capability.

Change

• add the current Drizzle/Huge Blue staging composition and flock-backed SSH lease transport;
• remove the conflicting legacy attach-token foreign key idempotently;
• make the loopback staging attach route mint and envelope the short-lived relay capability;
• reject attach while a workspace is suspended.

Validation

• cd web && bun run typecheck
• 29 focused Huge Blue/provider/relay/persistent-workspace/runtime-composition tests
• Big Red API and broker systemd health
• Huge Blue relay/proxy health
• route-driven Huge Blue soak: create/replay, native attach, crash/reconnect retained output, rotation, suspend/resume, token expiry, stop/replay cleanup

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the Huge Blue staging flow so the merged runtime composes correctly and returns a usable short-lived attach capability.

• Adds the current Drizzle/Huge Blue staging composition, a flock-backed SSH lease transport, and an HTTP loopback that mints attach tokens and rechecks them against the database on every upgrade.
• Drops the legacy attach-token runtime FK idempotently; attach is scoped to the owned persistent workspace and huge-blue is enforced as the provider.
• Attach is rejected with 409 unless a workspace is in a running state; rotation returns a freshly minted target envelope.
• Validation: cd web && bun run typecheck, 29 focused provider/relay/runtime-composition tests, and a route-driven soak covering create/replay, native attach, crash/reconnect, rotation, suspend/resume, token expiry, and stop/replay cleanup.