fix token persistence

[luke-lombardi]

Summary by cubic

Make private pool join tokens persistent and machine-scoped to handle long provider boot times. Revoke tokens on reservation close or rollback, and keep legacy tokens (without PoolCreatedAt) working.

• Bug Fixes

  • Use non-expiring, machine-scoped tokens in launchPoolCapacityLocked; replaces TTL-based token path.
  • Revoke reservation tokens in terminateReservation and during launch rollback.
  • Accept legacy tokens with zero PoolCreatedAt; compare timestamps only when both exist.
  • Clarify error: "join token was issued for a previous instance of this pool."
  • Add tests for legacy token acceptance and the new error.

• Refactors

  • Add createPersistentPrivatePoolJoinCommandForWorkspace() and joinCommandForToken().
  • Update call sites to use the persistent join command.

^{Written for commit 4b0dca5. Summary will update on new commits.}