Run every heartbeat on the clock its caller passed

[ppXD]

Summary

• HeartbeatLoop.RunAsync's TimeProvider was optional and defaulted to TimeProvider.System, so both AgentRunExecutor call sites (launch, line 270; re-attach, line 804) silently stayed on the wall clock. It is now required, and both sites pass the DI-registered _clock they already hold. The system provider's Delay IS the Task.Delay this used before, so the production cadence is byte-identical.
• A_failing_ping_is_reported_but_does_not_kill_the_loop asserted that at least two real 20 ms ticks fitted inside a real 200 ms CancelAfter window. On a loaded runner one did — red on Reclaim the settled cleanup receipts nothing cites any more #2001's unit run 35476566751 (pings should be >= 2 but was 1) and on a full-suite run the day before, from diffs touching nothing near this loop. It now advances a FakeTimeProvider and asserts exactly one ping per elapsed interval plus one report per ping, which is the property that was meant.
• AgentRunLiveness.HeartbeatInterval is pinned as a literal (100 s = a third of the default 5-minute window). A fake clock proves the loop honours whatever interval it is handed; it says nothing about which one production hands it, and nothing else pinned that number.

Test plan

• Unit: HeartbeatLoopTests (4) + AgentRunLivenessTests (13) green, 0.9 s (was dominated by a 200 ms wall-clock wait)
• Determinism: converted class run 20x clean and 20x under 8 CPU hogs — 40/40 green
• Regression: full unit suite 10907/10907 green
• Mutation — literal cadence pin: DefaultWindow 5 min → 6 min reds HeartbeatInterval_defaults_to_one_hundred_seconds (should be 00:01:40 but was 00:02:00)
• Mutation — required-clock pin: re-adding = null! reds The_clock_cannot_be_omitted_by_a_call_site
• Mutation — the converted test still catches its own regression: adding throw; after onPingError(ex) reds it (ping 2 never arrived)
• dotnet build CodeSpace.sln: 0 errors (warnings pre-existing)

Follow-up, not in this PR

SupervisorGradingHeartbeatTests is the one remaining wall-clock heartbeat test in the unit project (SupervisorTurnService.RunGradingHeartbeatLoopAsync uses a bare Task.Delay, 15 ms interval, ShouldBeGreaterThanOrEqualTo(3)). It is already hardened against the fixed-window shape — it waits for three observed ticks under a 10 s deadline rather than counting ticks in a fixed window — so it is not flaky the same way. Converting it means threading a TimeProvider through SupervisorTurnService's 17-parameter constructor at ~11 construction sites across unit, integration and E2E, which does not belong in this diff.

AgentProgressLeaseTests was checked and is already fully FakeTimeProvider-driven. No other unit test in the heartbeat/lease family counts wall-clock ticks.