fix: reset exhausted SecAgent draw roster

[PANDAJSR]

Summary

• Automatically reset the temporary student roster when a SecAgent no-repeat draw exhausts the matching candidates.
• Only reset when matching candidates exist and the draw failed specifically due to the repeat limit.
• Preserve tag, ID, and name filtering behavior.

Verification

• dotnet test SecRandom.Core.Tests/SecRandom.Core.Tests.csproj -c Release --no-restore --filter FullyQualifiedName~CoreRuntimeServicesTests
• 10 tests passed before syncing with upstream.
• The SecRandom build was blocked locally after sync because the newly introduced upstream PluginSdk/Markdown dependencies require a package restore that did not complete in this environment.