feat: wire runner restart counters (RestartCount/RestartTime) (step 2)

[eminwux]

Summary

• Phase 2 of the restart-on-exit epic (planning: runner — container restart-on-exit (reconciler-driven) + restart counters #1151). Step 1 (runner: reconciler restart-on-exit for non-root containers (step 1) #1233, PR feat: reconciler restart-on-exit for non-root containers (step 1) #1308) landed the reconciler restart pass (maybeRestartExitedContainers in refresh.go) as the single place a non-root container restart happens. This step makes that pass the sole writer of the user-visible RestartCount/RestartTime counters and turns populateCellContainerStatuses into a pure preserver of them.
• Sole-writer increment (refresh.go): new stampContainerRestart helper, called from maybeRestartExitedContainers immediately after a successful relaunch — bumps RestartCount by exactly one over the preserved prior and stamps RestartTime = r.nowUTC(). StartContainer re-derives statuses from the persisted (preserved) prior, so the bump lands on top of it; ReconcileCell's restartFired branch then persists the incremented value via the existing persistCellStatusGuarded path. Single increment site ⇒ exact, monotonic count that survives ticks.
• Pure preserver (helpers.go): populateCellContainerStatuses now snapshots priorRestartCount/priorRestartTime (same observe-and-preserve contract as CreatedAt/StartTime/ExitCode) and carries them across the unconditional overwrite. It never increments; a never-restarted container preserves zero from zero. The prior intentionally-zero block is gone.
• Comment refresh (runner.go): the restartStates doc-comment previously flagged the user-visible counters as "runner: restart counters (RestartCount/RestartTime) (step 2) #1234's scope (documented intentionally-zero in chore(controller): document RestartCount/RestartTime as intentionally-zero pending #1151 #1303)"; updated to point at stampContainerRestart / the populate preserve now that they're wired.

Premise-rot note (salvageable — flagged per dev CLAUDE.md)

The issue's Proposal says to "Replace the TODO(#1146) markers (helpers.go:864-865)". Those markers no longer exist: #1303 (the #1146 marker-documentation chore) landed first and replaced them with intentionally-zero comments, which had since shifted to ~helpers.go:1057-1070. Per the issue's own "Ordering vs #1146" note ("if #1146's marker-documentation chore lands first, this step supersedes its comments"), I superseded the current intentionally-zero block rather than the original TODO(#1146) text. Intent unchanged — these are the same lines, just relabeled and relocated by the intervening chore.

Test plan

• make test (full CI suite, test-root + test-kukebuild) — green, MAKE-TEST-EXIT=0, no FAIL lines.
• GOWORK=off go build ./internal/controller/runner/ and go vet — clean.
• New colocated unit tests in internal/controller/runner/restart_on_exit_test.go:
  • TestMaybeRestartExitedContainers_BumpsRestartCounterByOne — increment-by-one + RestartTime stamp on a fired restart; root container untouched (AC 1, 2).
  • TestMaybeRestartExitedContainers_RestartCounterMonotonic — prior 4 → 5, no reset (AC 4).
  • TestMaybeRestartExitedContainers_NoBumpWhenNoRestartFires — sole-writer contract: a no-fire tick leaves the counters exactly as preserved.
  • TestPopulateCellContainerStatuses_PreservesRestartCounters — populate preserves across two passes, never increments (AC 3, 5).

Acceptance criteria

• RestartCount increments by exactly one per reconciler-driven restart and survives subsequent reconciliation passes (increment in the restart pass + populate preserve).
• RestartTime reflects the wall-clock time of the most recent restart and survives subsequent passes.
• populateCellContainerStatuses never increments — pure preserver; the intentionally-zero block (the relabeled TODO(#1146) markers — see premise-rot note) is gone.
• Counters are monotonic (no reset while the container record lives).
• Unit coverage colocated with runner tests: counter increment on restart, preservation across populate passes.

Closes #1234

[eminwux]

PR #1333 Review — feat: wire runner restart counters (RestartCount/RestartTime) (step 2)

LGTM — makes maybeRestartExitedContainers the sole writer of the user-visible restart counters via stampContainerRestart (bump-by-one after a successful relaunch) and turns populateCellContainerStatuses into a pure preserver under the same observe-and-preserve contract as CreatedAt/ExitCode. The increment lands on the preserved prior and the restartFired branch persists it with no intervening populate, so the count is exact and monotonic across ticks. Tests cover both halves (increment + monotonic + no-fire, and two-pass preserve), all commits verified, full CI green including make e2e.