feat: ship single-file run distribution and list key reset

Compile-time run auth replaces zip sidecars, lengthens run keys, revokes
active sessions on reset, and exposes run-key reset in the server list.

platform/service/control.go

@@ -210,6 +210,49 @@ func (svc *CoreService) currentRunSession(runEndpointID string, sessionToken str
 	return domain.CopyRunControlSession(session), nil
 }
 
+func (svc *CoreService) revokeRunControlSessionForInstance(instance domain.ServerInstance) error {
+	if strings.TrimSpace(instance.RunEndpointID) == "" {
+		return nil
+	}
+	svc.controlMu.Lock()
+	defer svc.controlMu.Unlock()
+
+	session, err := svc.store.RunControlSessions().Get(instance.RunEndpointID)
+	if err != nil {
+		if errors.Is(err, repo.ErrNotFound) {
+			delete(svc.runSessions, instance.RunEndpointID)
+			return nil
+		}
+		return err
+	}
+	if session.Status == domain.AuthSessionStatusActive {
+		stamp := svc.now()
+		session.Status = domain.AuthSessionStatusRevoked
+		session.RevokedAt = stamp
+		session.UpdatedAt = stamp
+		if err := validator.ValidateRunControlSession(session); err != nil {
+			return err
+		}
+		if err := svc.store.RunControlSessions().Update(session); err != nil {
+			return err
+		}
+	}
+	delete(svc.runSessions, instance.RunEndpointID)
+
+	endpoint, err := svc.store.RunEndpoints().Get(instance.RunEndpointID)
+	if err != nil {
+		if errors.Is(err, repo.ErrNotFound) {
+			return nil
+		}
+		return err
+	}
+	endpoint.Status = domain.RunEndpointStatusOffline
+	if err := validator.ValidateRunEndpoint(endpoint); err != nil {
+		return err
+	}
+	return svc.store.RunEndpoints().Update(endpoint)
+}
+
 func runAuthenticationError(requireSigned bool) error {
 	if !requireSigned {
 		return validationError("sessionToken is invalid")