Replace Reset and Machine removal with Leave and Forget#1671

Fifth PR of the Machine RPC catalog simplification. Leave and Forget replace Reset, RemoveLocalMachine and RemoveMachine.

What changes

• Leave takes no fields. It cleans managed containers, departs storage, persists the reset, deletes the Machine's own replicated row best effort, and restarts the daemon. The restart happens even when the row delete fails, because nothing reaches the old daemon after removal. A resend reads the phase back:
  • an Uninitialized Machine answers left: uninitialized and does nothing;
  • a Resetting Machine resumes the cleanup;
  • Leave while an upgrade runs answers refused with conflict.
• Forget takes a machine_id and deletes that Machine's replicated row. A missing row counts as success. A Machine refuses to Forget itself.
• ployz server rm sends Leave to the target. When the target isn't the entry, it then sends Forget to the entry. The CLI drops its observe-after-lost-reply path, because a resend now reads the phase back.
• Cloud removal checks each Server with serverSupports before it sends. It refuses up front only when a Server is known to lack Leave or Forget. When the RuntimeWatch frame is missing, or a capability list is empty, the capability reads as unknown and the removal goes out anyway. A daemon refusal comes back as server_lacks. The new requirements entries are leave and forget, feature "Server removal".
• A removal is safe to send again.
  • The SDK's removal runs every check again on each send while the Server is listed: the entry refusal, the last-managed hold, Data Loss and held Volume copies.
  • A Server already gone from the list by its Machine ID answers removed, with the warning that its reset couldn't be confirmed. Only a Leave reply confirms a reset.
  • A Cloud step retry sends the same removal again instead of ending lost, so the lost outcome is gone. A run that no longer owns the attempt asks nothing.
  • A Leave the target answered stays evidence when the Forget after it fails. The SDK returns the Forget's error with {left: true, reset_warning} in its details, and Cloud keeps that as a left step result. A forget-machine step then sends Forget alone, retried until it lands, and release uses the Leave's warning. A retry never sends the removal again, which a reset Server could no longer answer. The CLI says "Server web-2 reset but is still listed." and prints ployz server rm web-2 --no-reset.
• Cloud refuses to start a removal for a Machine ID its RuntimeWatch frame doesn't list, with the same frame check an agent's removal runs.
• core/DESIGN.md names Reset, RemoveLocalMachine and RemoveMachine as removed under rule 6 with no shim.
• docs/user/servers/manage-servers.md says a removal stops with "Server removal needs a newer Ployz on web-1" when a Server lacks it, and how to finish a removal whose Server reset but is still listed.

Who notices

Cloud ships when this merges. Until the release, and until the three live Servers are upgraded, a Cloud removal that touches a v0.2.4 Server stops with "Server removal needs a newer Ployz on ". The installed v0.2.4 CLI keeps removing Servers through its own verbs. After the release, the new CLI refuses the same way on any Server not yet upgraded.

Draft until the top of the stack is verified end to end.