A warm floor is re-established at every boot, and ensure_ready() went straight
to _provision_one(). The adoption logic — "a pod for this pool is already
running, take it over" — existed only inside acquire(), so the warm path never
saw it. Three restarts on the production orchestrator this afternoon rented
three A40s and left each previous one billing until the reaper's 20-minute
grace expired. An hourly unattended upgrade would have done that every hour.

find_shared_pod already covers the case: after a restart the recorded pid no
longer matches, so our own previous pod is adoptable. It is now one method,
_adopt_shared_pod, called from acquire(), ensure_ready() and maintain()'s warm
top-up.

It also stops lying about the cost. An adopted pod was recorded at $0/hr as
"billed by its owner", which is true of a sibling engine's pod and false of one
we are inheriting from our own restart — a real A40 hidden from the $/hr cap and
from the spend page. register_pod now stores the rate and adoption restores it;
an older registry entry without one still adopts, at 0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>