Heartbeat-first dispatch: retire WoL-as-default, add WaitingReboot

Every supported host runs vetting-reporter in-OS and heartbeats every
30s. WoL was never the thing that started vetting — the heartbeat
response's reboot_for_vetting command was. Firing WoL first only
crowded the run log with misleading diagnostics when the real failure
mode is "reporter isn't installed."

- StartRun 409s if the host hasn't heartbeated within 60s, pointing
  the operator at /register/quick.sh.
- Dispatcher re-checks LastSeenAt at dispatch time (run may sit in
  Queued long enough for the host to go offline); stale hosts mark
  the run Failed with failed_stage=dispatch instead of looping.
- New StateWaitingReboot + TriggerRebootCommanded capture the actual
  semantics. StateWaitingWoL kept as the hook point for a future
  manual-override button.
- Tile disables the Start button with a quick.sh tooltip when the
  host is offline, matching the server-side 409.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/model/model.go

@@ -23,6 +23,7 @@ const (
 	StateRegistered     RunState = "Registered"
 	StateQueued         RunState = "Queued"
 	StateWaitingWoL     RunState = "WaitingWoL"
+	StateWaitingReboot  RunState = "WaitingReboot"
 	StateBooting        RunState = "Booting"
 	StateInventoryCheck RunState = "InventoryCheck"
 	StateSpecValidate   RunState = "SpecValidate"