Heartbeat-first dispatch: retire WoL-as-default, add WaitingReboot

Every supported host runs vetting-reporter in-OS and heartbeats every
30s. WoL was never the thing that started vetting — the heartbeat
response's reboot_for_vetting command was. Firing WoL first only
crowded the run log with misleading diagnostics when the real failure
mode is "reporter isn't installed."

- StartRun 409s if the host hasn't heartbeated within 60s, pointing
  the operator at /register/quick.sh.
- Dispatcher re-checks LastSeenAt at dispatch time (run may sit in
  Queued long enough for the host to go offline); stale hosts mark
  the run Failed with failed_stage=dispatch instead of looping.
- New StateWaitingReboot + TriggerRebootCommanded capture the actual
  semantics. StateWaitingWoL kept as the hook point for a future
  manual-override button.
- Tile disables the Start button with a quick.sh tooltip when the
  host is offline, matching the server-side 409.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/web/templates/host_tile_test.go

@@ -42,9 +42,15 @@ func TestHumanAgoFrom(t *testing.T) {
 // TestHostTile_OverlayLink asserts the tile includes the tile-link <a>
 // that makes the whole card clickable. The action button stays a
 // sibling element, so CSS (z-index) keeps it on top of the overlay.
+//
+// Heartbeat must be fresh because canStart now gates on LastSeenAt —
+// an offline host renders a disabled button (no form), which is
+// covered by TestHostTile_DisabledStartWhenOffline below.
 func TestHostTile_OverlayLink(t *testing.T) {
+	now := time.Now()
 	data := TileData{
-		Host: model.Host{ID: 42, Name: "tile-test", MAC: "aa:bb:cc:dd:ee:ff"},
+		Host:       model.Host{ID: 42, Name: "tile-test", MAC: "aa:bb:cc:dd:ee:ff"},
+		LastSeenAt: &now,
 	}
 	var buf strings.Builder
 	if err := HostTile(data).Render(context.Background(), &buf); err != nil {
@@ -57,7 +63,7 @@ func TestHostTile_OverlayLink(t *testing.T) {
 	if !strings.Contains(html, `class="tile-link"`) {
 		t.Fatalf("tile missing tile-link class: %s", html)
 	}
-	// canStart(nil) is true → Start form must be present.
+	// Fresh heartbeat + no run → Start form must render.
 	if !strings.Contains(html, `/hosts/42/start`) {
 		t.Fatalf("expected Start vetting form in tile: %s", html)
 	}
@@ -70,6 +76,26 @@ func TestHostTile_OverlayLink(t *testing.T) {
 	}
 }
 
+// TestHostTile_DisabledStartWhenOffline: no heartbeat → disabled button
+// with the quick.sh tooltip, not a submittable form. Mirrors the
+// server-side StartRun 409 so the UI matches the handler.
+func TestHostTile_DisabledStartWhenOffline(t *testing.T) {
+	data := TileData{
+		Host: model.Host{ID: 42, Name: "tile-test", MAC: "aa:bb:cc:dd:ee:ff"},
+	}
+	var buf strings.Builder
+	if err := HostTile(data).Render(context.Background(), &buf); err != nil {
+		t.Fatalf("render: %v", err)
+	}
+	html := buf.String()
+	if strings.Contains(html, `/hosts/42/start`) {
+		t.Fatalf("offline host should not expose a Start form: %s", html)
+	}
+	if !strings.Contains(html, `disabled`) || !strings.Contains(html, `quick.sh`) {
+		t.Fatalf("expected disabled Start button with quick.sh tooltip: %s", html)
+	}
+}
+
 func TestLastSeenLabelAndClass(t *testing.T) {
 	if got := lastSeenLabel(nil); got != "never" {
 		t.Fatalf("label nil = %q, want never", got)