In-graph orchestrator that survives restarting its peers — how does it fit #17722?

_Context: following a working session with the Aspire team (@maddymontaquila, @davidfowl, @DamianEdwards, @joperezr) on agent-driven inner loops on Aspire. Part of #18544._

We've been putting the orchestrator for our inner-loop *inside* the Aspire graph — one `aspire run` brings up the services and the thing that drives them, with discovery and telemetry for free. The control surface for that mostly exists already: `ResourceCommandService` drives lifecycle and `ResourceNotificationService.WatchAsync` observes peer health from inside the host. So this isn't really an API ask.

The one sharp edge: when the orchestrator restarts the peers it's recovering, and it's a node in that same graph, restarting them tends to take it down too. We work around it with an external supervisor that bounces the whole host and resumes the orchestrator from a checkpoint — a lot of machinery whose entire purpose is "let the controller outlive a restart of what it controls."

@davidfowl's draft spec (#17722, Custom Resource Lifecycle Model — `BoundTo` / `RunAsync` / `OnStarted`/`OnStopping`) looks like it's circling the same lifecycle-ownership problem. So the question is mostly: does #17722 already give a node a way to be lifecycle-decoupled from the subgraph it drives, or is "a controller that restarts its peers and survives" a distinct case worth calling out there? Happy to bring the concrete inner-loop scenario to that thread rather than spin up a parallel design.

Start with #17722 and the existing ResourceCommandService and ResourceNotificationService.WatchAsync entry points described in the issue. Determine whether the lifecycle model covers a controller surviving peer restarts; done is an agreed scope or decision about extending #17722 rather than a separate implementation.

Written by the indexing model from the issue text.