A-batch admin-plane fixes: rusage unit name, XCE_JOBID identity, select WARN, CLI env, docs

rusage collection (merge cb0c7fe9 regression, root cause of 0 counters):
- collect_job_rusages builds the systemd unit name with
  make_job_sd_unit_name (four-segment fmt_jobid_ex form) instead of a bare
  %lu of the packed uint64, so the D-Bus property lookups hit the real
  per-job unit again. E2E on t1: DONE job reports max_mem/avg_mem/cpu_time
  non-zero (previously all 0).

XCE_JOBID written identity:
- exdata sets XCE_JOBID via fmt_jobid (four-segment
  cluster-apiserver-timestamp-seq) instead of a bare packed decimal;
  XCE_JOBINDEX handling unchanged.
- xrun parses XCE_JOBID with parse_jobid (accepts the four-segment form);
  a bare decimal no longer round-trips through the written identity.
- E2E on t1: job sees XCE_JOBID=<submit id>; xrun remote-start round-trip
  to another host matches the job.

select WARN (silent degradation):
- parse_resreq_primary WARNs when a select references an unregistered
  resource ("...references an unregistered resource -- dropping the select
  and skipping any rusage[] clause of this primary") instead of failing
  silently; scheduler log shows the WARN on t1 and the job schedules
  without the constraint.

CLI env handling (unit-tested; subEnvVars is not flag-bound so this is
not reachable from the production CLI):
- getEnvironmentVariables keeps B=b=c (split at first '=') and warns +
  drops a bare key or an '=value' fragment instead of silently mis-parsing.

Docs:
- src/docs/xce.md: document the dead-clause semantics (select/rusage
  primary drop behavior) matching the WARN.

bug-1972 (test-only UAF): test_job_live_gc asserted job destruction by
reading refcount from the freed job; rewrite the assertion to observe
destruction without touching freed memory. controller_unit_test is green
again (1354 tests).

Regenerate 3 repl_trace_baseline fixtures whose baselines shifted with the
select-WARN logging; replay tests green.

Spec naming: external-license-resources design.md/brief.md fix the
self-referential daemon-name note (old drafts said xceextresd/extresd).

Verified on t1: rusage_burn job (counters non-zero in DONE), echo_env job
(four-segment XCE_JOBID), select[nosuchres] job (WARN + schedules),
xrun t2 remote-start round-trip, CLI env unit tests, xcelib 762 /
controller 1354 / worker exdata 8+11 / sched repl_trace 4+14+4+10+17
tests green.

Co-Authored-By: Claude Code <noreply@anthropic.com>

src/lib/testsuite/test_select.c

@@ -128,6 +128,33 @@ test_select_parse_unknown_resource(void)
     sel_optimize_test_reset();
 }
 
+static void
+test_select_unknown_resource_skips_rusage(void)
+{
+    /* The -ENOENT tolerance (bug-1887) drops the select AND the primary's
+     * rusage clause with it (parse_resreq_primary returns before parsing
+     * rusage) -- now with a WARN. Assert the documented drop semantics:
+     * rc carries -ENOENT and no rusage survived, so callers can never
+     * mistake the tolerated failure for a fully-parsed primary. */
+    char *               errmsg = NULL;
+    xce_primary_resreq_t resreq;
+
+    var resmgr = make_test_resmgr();
+
+    sel_optimize_set(0);
+
+    int rc = parse_resreq_primary(&resreq, "unknownres==linux rusage[mem=2]",
+                                  resmgr, &errmsg);
+    TEST_ASSERT_EQUAL_INT(-ENOENT, rc);
+    TEST_ASSERT_NULL(resreq.select);
+    TEST_ASSERT_EQUAL_INT(0, resreq.rusages.count);
+
+    kill_primary_resreq(&resreq);
+    FREEUP(errmsg);
+    free_test_resmgr(resmgr);
+    sel_optimize_test_reset();
+}
+
 static void
 test_select_parse_type_mismatch(void)
 {
@@ -2346,6 +2373,7 @@ test_select(void)
     RUN_TEST(test_select_parse_valid_expr);
     RUN_TEST(test_select_parse_valid_any);
     RUN_TEST(test_select_parse_unknown_resource);
+    RUN_TEST(test_select_unknown_resource_skips_rusage);
     RUN_TEST(test_select_parse_type_mismatch);
 
     RUN_TEST(test_select_input_len_overflow);