fix(job): supervise scheduled manual runs on host

[vishr]

Summary

• run scheduled manual jobs under their existing host-owned systemd unit
• add ob job run --detach for durable acceptance without waiting
• preserve sealed release/runtime binding at the host execution boundary
• animate announced long steps and show elapsed time using the existing UI
• document follow/detach behavior and extend the real SSH/systemd/Docker lifecycle test

Design

This reuses the scheduled-job runner rather than introducing a daemon, helper binary, detached Docker path, or second state store. The unit remains the authority for timeout, retries, overlap protection, container cleanup, logs, and run history.

Before submission, Onebox stages the approved release and runtime digest. The installed runner validates both after acquiring its host locks and before starting the container. Older installed runners are refused with ob schedule apply guidance.

Foreground mode follows the systemd unit and reports its host-recorded outcome. Ctrl-C stops following but does not cancel the unit. --detach returns after systemctl start --no-block accepts the activation and prints the operation ID plus the existing history command.

The loader change stays inside internal/ui: TTYs get animation plus elapsed time; pipes and CI retain plain start/completion lines; structured output remains untouched.

Verification

• just check
• just server-e2e — passed against a disposable Lima VM with real SSH, systemd, and Docker (662.721s)

Closes #189