The last hole in the warm path. sibling_is_provisioning already recognises a
pod registered at creation with no URL yet — and after a restart the recorded
pid no longer matches, so our own booting pod qualifies — but ensure_ready
never asked. Seen live: a pod created at 18:57 was six minutes into its image
pull when the 19:03 upgrade restarted the service, and the warm path rented a
second A40 beside it. The upgrade runs hourly and an image pull is ~6 minutes,
so that is not a rare alignment.

Order in ensure_ready is now: a healthy pod of our own, else adopt a ready one,
else wait for one that is booting, else rent.

Also prune the pod registry in reap_orphans: an id RunPod no longer has stayed
"known", which both shielded it from reaping and let the file grow for the life
of the install — including pods terminated out of band, of which this afternoon
produced five.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>