Refactor LLM runtime handling and enhance CLI documentation

- Updated `resolve_llm_runtime` to prioritize live configuration over legacy notes, ensuring accurate runtime resolution.
- Enhanced `tunnel_forwards` to prefer current configuration for LLM runtime, improving tunnel setup logic.
- Improved idle-killer logic to handle stale markers and provide clearer warnings in the status output.
- Updated CLI documentation in `cli.md` to reflect changes in command behavior and runtime handling.
- Enhanced tests to validate new runtime resolution logic and ensure proper handling of configuration states.

src/gpu_rent/session.py

@@ -98,8 +98,12 @@ def _bind_access(
         "test -f /opt/swarmui/.gpu-rent-bootstrapped && echo yes || echo no",
         check=False,
     ).strip()
-    if marker == "yes" and state.bootstrapped:
-        log("bootstrap уже на VM — лёгкий проход (без apt)")
+    if marker == "yes":
+        # VM marker survives stop; local bootstrapped is cleared on stop — still light.
+        if not state.bootstrapped:
+            log("маркер bootstrap на VM — лёгкий проход (локальный bootstrapped был сброшен)")
+        else:
+            log("bootstrap уже на VM — лёгкий проход (без apt)")
         run_bootstrap(cfg, ip, log, update=update, light=True)
     else:
         run_bootstrap(cfg, ip, log, update=update, light=False)
@@ -391,6 +395,13 @@ def cmd_stop(
         else:
             log("compute уже нет")
 
+        try:
+            from gpu_rent.idle_killer import revoke_old_credentials
+
+            revoke_old_credentials(conn, log)
+        except Exception as exc:
+            log(f"revoke idle-killer app cred: {exc}")
+
         if not cfg.keep_floating_ip:
             delete_floating_ip(conn, state.floating_ip_id, state.floating_ip, log)
             state.floating_ip = None