A-batch admin-plane fixes: rusage unit name, XCE_JOBID identity, select WARN, CLI env, docs

rusage collection (merge cb0c7fe9 regression, root cause of 0 counters):
- collect_job_rusages builds the systemd unit name with
  make_job_sd_unit_name (four-segment fmt_jobid_ex form) instead of a bare
  %lu of the packed uint64, so the D-Bus property lookups hit the real
  per-job unit again. E2E on t1: DONE job reports max_mem/avg_mem/cpu_time
  non-zero (previously all 0).

XCE_JOBID written identity:
- exdata sets XCE_JOBID via fmt_jobid (four-segment
  cluster-apiserver-timestamp-seq) instead of a bare packed decimal;
  XCE_JOBINDEX handling unchanged.
- xrun parses XCE_JOBID with parse_jobid (accepts the four-segment form);
  a bare decimal no longer round-trips through the written identity.
- E2E on t1: job sees XCE_JOBID=<submit id>; xrun remote-start round-trip
  to another host matches the job.

select WARN (silent degradation):
- parse_resreq_primary WARNs when a select references an unregistered
  resource ("...references an unregistered resource -- dropping the select
  and skipping any rusage[] clause of this primary") instead of failing
  silently; scheduler log shows the WARN on t1 and the job schedules
  without the constraint.

CLI env handling (unit-tested; subEnvVars is not flag-bound so this is
not reachable from the production CLI):
- getEnvironmentVariables keeps B=b=c (split at first '=') and warns +
  drops a bare key or an '=value' fragment instead of silently mis-parsing.

Docs:
- src/docs/xce.md: document the dead-clause semantics (select/rusage
  primary drop behavior) matching the WARN.

bug-1972 (test-only UAF): test_job_live_gc asserted job destruction by
reading refcount from the freed job; rewrite the assertion to observe
destruction without touching freed memory. controller_unit_test is green
again (1354 tests).

Regenerate 3 repl_trace_baseline fixtures whose baselines shifted with the
select-WARN logging; replay tests green.

Spec naming: external-license-resources design.md/brief.md fix the
self-referential daemon-name note (old drafts said xceextresd/extresd).

Verified on t1: rusage_burn job (counters non-zero in DONE), echo_env job
(four-segment XCE_JOBID), select[nosuchres] job (WARN + schedules),
xrun t2 remote-start round-trip, CLI env unit tests, xcelib 762 /
controller 1354 / worker exdata 8+11 / sched repl_trace 4+14+4+10+17
tests green.

Co-Authored-By: Claude Code <noreply@anthropic.com>

src/controller/testsuite/test_job_live_gc.c

@@ -160,13 +160,21 @@ static void test_sweep_purges_expired_done_job(void)
 
     TEST_ASSERT_EQUAL_INT(3, jlg_job_count());
 
+    /* Refcount before the sweep: seed gives the table 1, and nothing else
+     * holds the job. Read NOW — a correct sweep dereferences down to
+     * job_destroy and FREES the whole RTTI object, so touching `expired`
+     * after the sweep is a use-after-free (the assertion that proved
+     * "refcount reached 0" by reading freed memory was itself the bug;
+     * destruction is verified by absence below instead). */
+    TEST_ASSERT_EQUAL_UINT32(1, job_get_refcount(expired));
+
     job_live_gc_sweep(&g_jlg_c);
 
-    /* The expired job is gone from the table... */
+    /* The expired job is gone from the table — and, with the fixture
+     * holding no other reference, a correct sweep also destroyed it
+     * (refcount 1 → 0 through its two dereferences). `expired` must not
+     * be dereferenced past this point. */
     TEST_ASSERT_NULL(jlg_find_job(81001));
-    /* ...and its refcount ran down to destruction (seed refcount 1, sweep
-     * added 1, dereference after unlink leaves 0 → job_destroy ran). */
-    TEST_ASSERT_EQUAL_UINT32(0, job_get_refcount(expired));
 
     /* The others are untouched. */
     TEST_ASSERT_NOT_NULL(jlg_find_job(81002));