[Request]: per-incarnation identity and conditional lifecycle operations

### Feature or enhancement request details

Please expose a server-generated per-incarnation token (or a separately generated immutable object ID) and support atomic conditional lifecycle operations, especially delete.

Today a container has no name separate from its ID (`ManagedContainer.name` returns `configuration.id`). A caller can explicitly reuse a deleted container's ID with `--name`. A delayed cleanup carrying the old ID can therefore delete the replacement:

```sh
ID=repro-reuse-0123456789ab
IMAGE='docker.io/library/alpine@sha256:'

container create --name "$ID" --network none --label repro.instance=A "$IMAGE" /bin/true
container inspect "$ID" # id=$ID, label=A
container delete "$ID"

container create --name "$ID" --network none --label repro.instance=B "$IMAGE" /bin/true
container inspect "$ID" # id=$ID, label=B

# Delayed cleanup from A, carrying A's former ID:
container delete "$ID"
container inspect "$ID" # not found: B was deleted
```

I reproduced this with:

- release 1.2.2, commit `0190097d06df0b9065f4c2d2c7873c649d81d493`
- a local debug build of current `main`, commit `d2213f49e6f72fdacf5b895b4d23120c18a456df`
- macOS 26.5.2 (25F84), Apple silicon

Structured current-main result:

```json
{"a_id":"repro-reuse-e010fda4fa7a","a_label":"A","b_id":"repro-reuse-e010fda4fa7a","b_label":"B","main_commit":"d2213f49e6f72fdacf5b895b4d23120c18a456df","replacement_deleted":true,"same_id":true}
```

This is not a UUID collision: explicit `--name` reuse is supported. Inspect-before-delete cannot solve it because replacement can occur between the two requests.

A useful API shape would be:

1. On create, the API server generates a cryptographically random `instanceToken` that the caller cannot choose.
2. Create returns `{id, instanceToken}` atomically, with JSON output available to CLI callers.
3. Inspect includes the token and persists it across API-server restart.
4. Lifecycle requests accept an optional expected token for compatibility. If supplied, the API server compares it while holding the same lock that selects and operates on the object.
5. A mismatch or missing token rejects without affecting the current object.

For example:

```sh
container delete --if-instance-token "$TOKEN_A" "$ID"
# Must reject if ID now denotes B.
```

The same precondition would be valuable for start, stop, kill, export/copy, and other ID-addressed operations so orchestrators do not have an inspect/use race.

A distinct server-generated immutable ID plus a reusable display name would also solve the addressing problem, provided lifecycle commands operate on the immutable ID and it cannot be reused. The key property is an atomic operation against one incarnation, not merely a random default ID.

This would let crash-recovering orchestrators implement the fail-safe rule: delete the exact object they created, or delete nothing and report an orphan.

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Start by tracing the API-server create, inspect, and delete entry points, including ManagedContainer.name, to understand identity persistence and the lock used for lifecycle operations. Define how the server-generated token is returned, stored, inspected, and checked atomically. Done means the documented ID-reuse scenario rejects stale cleanup without affecting the replacement, while compatible operations still work without a token.

Written by the indexing model from the issue text.