E2 Phase 1: external-license-resources — xceesd daemon, extres role, EXTERNAL admission

Implements Phase 1 of .kiro/specs/external-license-resources/ (design.md):
externally-reported license pools pushed by a dedicated daemon through the
existing resval pipeline, with EXTERNAL-aware admission arithmetic.

Wire & controller:
- controller.capnp HostRole.extres (@5, appended); xce_join_req accepts it
- extres.c: HostRole_extres join table (endpoint+name, no workermgr slot),
  leave cleanup; join.c/cluster.c dispatch
- opupd.c do_update_resvals: extres branch runs the resource hooks and
  update_resval_list(c, NULL, ...) — host=="" entries route through
  update_val_res' SHARED branch into c->sharedinst; per-entry -EPERM for
  non-shared targets is logged, never fails the list
- worker.c update_val_res: NULL worker only writes SHARED resources
- cluster.c cluster_build_resources: rebuilt on resourceApplyDef (bug-1854)
  — EEXIST-tolerant so definitions added by an activation register on a
  RUNNING controller (bug-1973), and RES_APPLY_CHANGED updates definition
  fields (valtype/ordtype/flags/interval) in place so a corrected config
  heals a stale registration (bug-1974); seed_sharedinst_from_config skips
  EXTERNAL pools (daemon-reported free counts only; seeding would fabricate
  capacity while the daemon is down)

Scheduler:
- core_events.c RESVALS_DELTA: NULL/"" host marks a SHARED value and lands
  in core->sharedInst via dup_val (bug-1585 ownership rule), mirroring
  snapshot_load's host=="" precedent — previously WARN-skipped as unknown
  worker
- resource.c unsatisfy_: EXTERNAL skips the inuse term
  (F >= uncomit + wanted; F is already net of our checkouts)

xceesd (src/esd, new component):
- script collectors polled per source, debounce on unchanged values,
  fail-open stale policy; pushes host=="" shared resvals over xcecli
- reconnect gap fix (bug-1975): with a stable value the debounce pushed
  nothing and reconnects only fire inside a push — after a controller
  restart the daemon sat on a dead connection forever; the main loop now
  forces a full re-push when xcecli_is_connection_broken() (bug-1760
  predicate) latches

Config/mapping:
- resources.yaml: extlic sample (location: [external])
- mapping.py: RESOURCE_FLAG_EXTERNAL (0x10) + location:["external"] mapping;
  xceadmin tests

Tests (TDD, red->green per fix): test_extres_resvals.c (join+resval
pipeline), test_config_resource_reconcile.c +2 (register past EEXIST /
hot-apply changed definition), test_core_events.c +131 lines (shared DELTA
landing), mapping tests. Suites: controller 1358/0, scheduler 100/0,
esd 7/0, lib 1/0; check-no-fork covers src/esd.

Live t1 E2E: config gen=15 push -> xceesd push extlic=4 lands in
sharedinst -> rusage[extlic=3] job RUN; second job PENDs at free=1;
release re-admits it; controller restart -> forced re-push restores the
value and admission resumes. Full precommit job verification passed.

Co-Authored-By: Claude Code <noreply@anthropic.com>

src/controller/opupd.c

@@ -23,7 +23,38 @@ static int do_update_resvals(cluster_t* c, endpoint_t* ep,
     if (priv != NULL) {
         int idx = priv->u.idx;
 
-        if ((priv->role == HostRole_worker) && (idx >= 0)) {
+        if (priv->role == HostRole_extres) {
+            /* external-license-resources Phase 1: the extres daemon
+             * (xceesd) pushes cluster-level values with NO workermgr slot
+             * -- w==NULL routes every entry through update_val_res()'s
+             * "SHARED 即收" guard (shared values land in c->sharedinst;
+             * host-based values are refused -EPERM per entry). The reply
+             * status is 0 for any syntactically valid list: per-entry
+             * refusals are logged by log_update_resval_failure() and must
+             * not fail the whole update (mirrors the worker path's
+             * per-item convention). */
+            xce_update_data_t* updatemsg = request->body.updatemsg;
+            xce_resval_list_t* resvals   = updatemsg->data.resvals;
+            xce_resval_list_t  applied   = { .count = 0, .vals = NULL };
+
+            if ((resvals != NULL) && (resvals->count > 0)) {
+                applied.vals = (xce_resval_t**)calloc(
+                    (size_t)resvals->count, sizeof(xce_resval_t*));
+            }
+
+            xce_run_hooks(&(c->hooksys), XCE_CONTROLLER_HOOK_RESOURCE,
+                          HOOK_BEFORE_EVENT, HOOK_DETAIL_RESOURCE_UPDATE, c,
+                          resvals);
+            update_resval_list(c, NULL, resvals,
+                               (applied.vals != NULL) ? &applied : NULL);
+            if (applied.count > 0) {
+                xce_run_hooks(&(c->hooksys), XCE_CONTROLLER_HOOK_RESOURCE,
+                              HOOK_AFTER_EVENT, HOOK_DETAIL_RESOURCE_UPDATE, c,
+                              &applied);
+            }
+            free(applied.vals);
+            rc = 0;
+        } else if ((priv->role == HostRole_worker) && (idx >= 0)) {
             worker_t* w = NULL;
 
             rc = vget(c->workermgr, idx, (void**)&w);