Pick the exec instance deterministically and say which one

[Shine-neko]

ring deployment exec picked its default instance with instances.into_iter().next(), and nothing upstream sorts: list_instances_with_names returns whatever order the Docker daemon gave. On an autoscaled deployment two consecutive execs could therefore land in different replicas, which is the failure mode where a fix looks like it did not take effect. The session also never said which replica it entered.

The default is now the first instance by name, with the id as a tiebreaker so duplicate names cannot reintroduce an arbitrary order. Sorting lives in resolve_instance rather than in each runtime, so no runtime has to remember to do it.

The chosen instance comes back on the upgrade response (x-ring-exec-instance, plus position and total), and the CLI prints Connecting to web-3b81d4 (1 of 3 running instances)... before the session takes over the screen. It goes on the handshake rather than as a first frame because the frame stream is the PTY: anything injected there would have to be escaped out of the user's own output. The qualifier only appears when there is more than one replica, and a client that ignores the headers still gets a working session.

--container is unchanged: still an exact match on id or name, still a 404 when it matches nothing.

The first commit is unrelated cleanup that CI needed: clippy::result_large_err now fires on two user handlers that predate this branch, silenced the same way require_scope and the token handlers already do.