Make supervised tunnel startup deterministic

[RobLe3]

Summary

• resolve cloudflared through an authoritative absolute IICP_CLOUDFLARED_PATH, then PATH, and preserve the resolved path in supervisor units
• preserve only an explicit IICP_TUNNEL override; unset keeps automatic reachability selection
• defer dynamic-route registration until the listener exists and recover immediately from the empty startup token
• make the mypy baseline use the active Python environment and replace the sleep-based recovery test with an event-driven assertion

Validation

• Ruff and mypy baseline pass
• full pytest: 1235 passed, 2 skipped, 9 subtests passed
• supervisor, tunnel and route-readiness qualification assertions pass

Closes #124