Ensure ShortID starts with alphanumeric character for Kubernetes compatibility (closes #39456)

What does this MR do?

Sanitises the output of ShortenToken() to ensure the shortened string starts with an alphanumeric character. If the first character is not alphanumeric (e.g. a dash), it is replaced with r.

Why was this MR needed?

Kubernetes labels and resource names require identifiers to start with an alphanumeric character. When a CI token happened to produce a shortened ID beginning with a dash (e.g. -abc123), the runner generated invalid pod names that Kubernetes would reject. This was observed with the Instance and Kubernetes executors where ShortID values are used in resource naming.

What's the best way to test this MR?

Existing tests in helpers/shorten_token_test.go verify the output format. The sanitisation is a single pass over the first character — any token producing a leading non-alphanumeric char now gets r prepended instead.

What are the relevant issue numbers?

Closes #39456 (closed)