Upsert devices and insert kernel_devices rows on kernel RUNNING transition (idempotent dual-write)

Write the devices and kernel_devices tables from the existing RUNNING transition path. No new event handler: KernelStartedAnycastEvent already flows through handle_kernel_started to update_kernel_status_running (repositories/scheduler/db_source/db_source.py), whose UPDATE is guarded by WHERE status IN (PREPARED, CREATING) and therefore filters duplicate event deliveries.

Scope:
- In the same transaction as the guarded UPDATE, when rowcount is positive: (1) bulk upsert devices on the (agent_id, device_name, device_id) unique constraint, updating model_name and updated_at on conflict - the agent id comes from KernelRow.agent, already selected in this method; (2) resolve the device row ids (RETURNING or a follow-up select) and insert kernel_devices rows with the per-attachment data, conflict-safe. Idempotency comes free from the status guard.
- Source entries come from KernelCreationInfo.get_attached_devices().
- Kernels with a null agent are skipped leniently.
- Keep the existing kernels.attached_devices JSONB write unchanged (dual-write): usage/period consumers stay on the JSONB until the read switch.
- Repository tests covering the scenarios below.

Success Criteria
- [ ] RUNNING transition from PREPARED or CREATING upserts devices and inserts one junction row per attached device in the same transaction
- [ ] a second kernel on the same agent device reuses the existing devices row (no duplicate device)
- [ ] duplicate kernel-started event for an already RUNNING kernel inserts nothing (rowcount guard)
- [ ] kernel with an empty attached_devices payload inserts no rows and does not fail
- [ ] the JSONB column write remains unchanged alongside the new table writes
- [ ] pants test passes for affected packages

JIRA Issue: BA-7179

Start in repositories/scheduler/db_source/db_source.py at handle_kernel_started and update_kernel_status_running, then inspect KernelCreationInfo.get_attached_devices() and the existing kernels.attached_devices write. Add repository tests for guarded transitions, shared devices, empty attachments, and JSONB preservation, then run pants test for the affected packages. Done means the listed scenarios pass in one transaction without duplicate rows.

Written by the indexing model from the issue text.