fix(coder-labs/claude-self-hosted-runner): infer lock status from active_sessions

The previous metadata script scraped
claude_code_self_hosted_runner_locked_account from /metrics. In
Anthropic BYOC build 2.1.97-byoc.9 the runner declares the HELP/TYPE
lines for that gauge but never emits a sample line, even when the
runner is actively serving sessions. The metadata item always
showed 'unlocked' regardless of state, which is wrong: a runner
with active_sessions > 0 has been locked to an Anthropic user for
its lifetime per Anthropic's spec.

Switch to inferring the lock status from /healthz's
active_sessions, and latch a sticky flag at $HOME/.claude/locked
on first observation of active_sessions > 0. Once locked, always
locked, even when the active count drops back to zero between
sessions of the same locked user.

Module tests still pass (6/6). Live verification will follow on the
bpmct/coder-dev-tunnel deployment.

registry/coder-labs/modules/claude-self-hosted-runner/main.tf

@@ -123,10 +123,20 @@ output "agent_metadata" {
       key          = "0_lock_status"
       interval     = 10
       timeout      = 5
+      # The runner does not expose its locked state via /metrics or
+      # /healthz in the current BYOC build, so we infer it from
+      # active_sessions and latch a sticky flag on disk: once a
+      # session has landed, the runner is locked to that Anthropic
+      # user for its entire lifetime per Anthropic's spec, even when
+      # the active count drops back to zero between sessions.
       script = <<-EOT
-        val=$(curl -fsS http://127.0.0.1:8080/metrics 2>/dev/null \
+        flag="$HOME/.claude/locked"
-          | awk '/^claude_code_self_hosted_runner_locked_account[[:space:]]/ {print $2; exit}')
+        active=$(curl -fsS http://127.0.0.1:8080/healthz 2>/dev/null \
-        if [ "$val" = "1" ]; then
+          | jq -r '.active_sessions // 0')
+        if [ "$${active:-0}" -gt 0 ] && [ ! -f "$flag" ]; then
+          touch "$flag" 2>/dev/null || true
+        fi
+        if [ -f "$flag" ]; then
           printf 'locked'
         else
           printf 'unlocked'