Preserve live development selection when manager refuses a rebuild or restart

[adrianwebb]

Objective

A refused manager stop must leave the selected live runtime unchanged. Parent: treeseed-ai/platform#520.

Reproduction and fix

The live Agent sandbox rebuild was refused while a Kata assignment claim was active. CLI restartConsumer had already changed its selection to released, despite unchanged guest trust. Move the selection transition after successful protected-manager stop; do not bypass custody or interrupt the assignment.

Acceptance

• Regression fails on the old order (released !== live).
• Public dev restart and dev rebuild both preserve live selection on stop refusal.
• Normal restart, explicit released selection, cleanup and lifecycle recovery still pass.
• Bind the public-command regression into the executable CLI golden scene.
• Required checked staging PR.

Evidence / rollback

Native Node tests managed-development-container.test.ts and lifecycle-entrypoints.test.ts: 2 passed. Further development tests and strict checks are in progress. No tag/RC, credential change or manager privilege bypass. Revert the bounded commit if necessary. The existing SDK golden continues unchanged.