VDI: reconcile CT-backed ephemeral desktop pools

[hanthor]

Part of #69.

Current behavior

Phase 1 pools clone KubeVirt VMs. Corral Containers (CT) have no pool definition, replica reconciliation, assignment integration, or golden-source recreation primitive.

Desired behavior

Add a small CT-backed pool reconciler for ephemeral Linux desktops without pretending Kubernetes has a VirtualMachinePool equivalent for CTs.

Acceptance criteria

• Define the CT pool source, desired size, member identity, and lifecycle state using a cluster-visible declarative model.
• Reconcile create, replace, scale-up, scale-down, and drift without deleting an actively assigned member.
• Integrate CT members with the atomic claim/release contract from VDI: add atomic pool-member claim and release #226.
• Release destroys and recreates an ephemeral member from its configured source; persistent CT semantics, if unsupported, fail explicitly.
• Capacity and partial-failure states are observable and recover automatically where safe.
• Deterministic reconciliation tests cover duplicate events, failed creation, drift, scaling, assigned-member protection, and release recreation.
• Document security, storage persistence, networking, and image prerequisites.

Out of scope

WebRTC/Selkies streaming and VM-backed pool behavior are separate children of #69.