## Summary

Stacked on #744. Implements the identity follow-up discussed on #735
(see the "Identity model note" comment there): the engine gains a
CRI-style orchestrator reference, and the runner stops squatting the
engine's `name` slot to carry the control-plane box id.

```text
before                                after
──────                                ─────
runner: WithName(cloudId)             runner: WithExternalRef(cloudId)
engine: name = cloudId (squatted)     engine: external_ref = cloudId
        name unavailable for users            name free for a future
                                              user-facing box name
```

Industry precedent (verified sources):
- CRI `PodSandboxMetadata.uid` — the orchestrator's id travels as a
dedicated metadata field; the runtime mints its own id ([cri-api
api.proto](https://github.com/kubernetes/cri-api/blob/master/pkg/apis/runtime/v1/api.proto),
`message PodSandboxMetadata`)
- ECS agent attaches `com.amazonaws.ecs.task-arn` as a docker label
([docker_task_engine.go](https://github.com/aws/amazon-ecs-agent/blob/master/agent/engine/docker_task_engine.go))
- The caller-supplied-id pattern (OCI runtime spec `create
<container-id>`) applies to stateless executors (runc/firecracker), not
to stateful daemons like this engine — hence a reference field, not id
injection.

## What changed

- **engine**: `BoxOptions.external_ref` (opaque, json-persisted via the
existing config blob — no DB migration; `lookup_box` already scans
configs). Duplicate refs are rejected at create. Lookup order: exact id
→ name → external_ref → id prefix. `BoxInfo` exposes it, omitted when
unset.
- **C SDK**: `boxlite_options_set_external_ref`, `CBoxInfo.external_ref`
(NULL when unset, freed on drop — the leak-count test now expects 5
inner CStrings), header regenerated by the crate build.
- **Go SDK**: `WithExternalRef`, `BoxInfo.ExternalRef`.
- **Node SDK**: field filled with `None` (orchestrator-facing knob; not
exposed in JS options yet).
- **CLI**: `inspect` shows `ExternalRef` only when present; `list`
columns unchanged (nothing empty is rendered).
- **runner**: `WithName(dto.Id)` → `WithExternalRef(dto.Id)`; restart
recovery (`runtime.Get(dto.Id)`) resolves through the external_ref
match.

## Verification

- engine lib tests: 735/735; the new `lookup_box_by_external_ref` test
was verified two-sided (fails with the lookup clause reverted, passes
restored)
- boxlite-c: 55/55
- CLI / Node / Python crates compile; `go vet` clean on `sdks/go` and
`apps/runner/pkg/boxlite` (final cgo link needs the prebuilt
`libboxlite.a`, absent in this worktree)

## Merge order

#743 → #735 → #744 → this PR. Self-contained: reverting is closing this
PR.