fix: report whether a runtime is still initializing in ListResources

[nishantmonu51]

ListResources returns 200 with an empty list when security policies deny every resource, which is what a deny-by-default project does for users entitled to nothing. Clients read that as "the runtime isn't ready yet" and polled forever behind a spinner that never resolved.

• Add initializing to ListResourcesResponse, computed from Controller.Initializing() rather than from the returned resources, so it stays meaningful when the response is empty or narrowed by kind/path.
• Controller.Initializing() latches: once the initial parse and reconcile completes it stays false for the controller's lifetime, so a model refresh or a hidden RefreshTrigger does not make the instance look like it is building again. A started flag set alongside Run's initial enqueue closes the window where every resource is still IDLE and the instance would report "done" before it had begun.
• useIsInitialBuild and the dashboards refetch interval now key off the flag instead of guessing from an empty list.
• Render an access-denied page on the canvas and explore embed surfaces, which previously showed a spinner or nothing at all for a denied user. ResolveCanvas now retries network errors only, so a 403 surfaces immediately instead of after five retries.

Checklist:

• Covered by tests
• Ran it and it works as intended
• Reviewed the diff before requesting a review
• Checked for unhandled edge cases
• Linked the issues it closes
• Checked if the docs need to be updated. If so, create a separate Linear DOCS issue
• Intend to cherry-pick into the release branch
• I'm proud of this work!

https://claude.ai/code/session_016toijNcMp2pV3UQ2WoZUhc