Add fail-closed apply for named runs

[wolegechu]

Summary

• add dstack apply --no-recreate for explicitly named dev-environment, task, and service runs
• treat only an owner-matching, unchanged run in a safe active state as a no-op, and fail before stop/apply for drift, recreation, ownership mismatch, or unsafe states
• expose an internal cancelled/no-op/submitted outcome with a run/deployment/user fence while preserving the existing apply_configuration() return contract
• document the behavior and cover the existing plan-to-apply optimistic fence when a same-name run appears concurrently

Part of #4123.

CLI transcript

$ dstack apply --help
Usage: dstack apply [--project NAME] [-h [TYPE]] [-f FILE] [-y] [--force | --no-recreate] [-d] [-v]
...
  --no-recreate         Fail instead of changing an active run; unchanged active runs are no-op

$ dstack apply --force --no-recreate
dstack apply: error: argument --no-recreate: not allowed with argument --force

Validation

• pytest -q src/tests/_internal/cli/commands/test_apply.py src/tests/_internal/cli/services/configurators/test_run.py src/tests/_internal/cli/services/configurators/test_run_no_recreate.py src/tests/_internal/server/routers/test_runs.py::TestApplyPlan::test_rejects_apply_when_active_run_appears_after_absent_plan (37 passed)

• ruff format --check on all changed Python files

• ruff check on all changed Python files

• git diff --check

• Pyright with the project virtual environment: 0 errors, 0 warnings

• pre-commit for the PR diff: passed

• mkdocs build --strict: passed

AI assistance

This PR was developed primarily with AI assistance from OpenAI Codex. I directed the design, reviewed the resulting diff, and ran the listed validations.