Make supervised tunnel startup deterministic

[RobLe3]

Summary

• make cloudflared resolution supervisor-safe and fail closed on invalid explicit overrides
• preserve explicit IICP_TUNNEL tri-state configuration in generated service units
• limit dynamic-route registration to one pre-listener attempt and recover immediately after bind
• extract the registration workflow so run_serve remains within the Sentrux complexity rule

Validation

• dependency policy, fmt, all-feature clippy and full all-feature tests passed in a disposable target
• disposable target was removed after the gate
• sentrux check . passes with no rule violations

Closes #162