feat(scheduler): add capacity credit registry

[DavidBellamy]

Closes #53.

Design context: LLM360/comet#576 and LLM360/comet#577.

Description

Problem

Comet must order fair work before large request bodies enter shared queues, while SMG remains the only authority that may reserve scheduler capacity. The handoff needs a short-lived, single-use, strongly bound credit contract before any endpoint or request-path wiring is added.

Solution

Add a transport-agnostic, process-local capacity-credit registry. The registry is intentionally unwired in this PR.

Changes

• add 256-bit URL-safe opaque tokens with redacted debug output
• bind credits to allocator generation, policy epoch, partition, canonical model, tenant, request attempt, and output estimate
• make exact duplicate issue idempotent while rejecting conflicting reuse
• make redemption atomic and single-use
• reject binding mismatch without consuming the rightful credit
• expire and cancel active credits while dropping payloads after releasing the registry lock
• retain bounded terminal tombstones to reject immediate replay
• expose no endpoint, configuration, CLI, Python binding, SlotPool integration, or request-path behavior

Test Plan

• cargo +nightly fmt --all -- --check
• cargo test -p smg --lib
  • 1,476 passed, 5 ignored
  • focused coverage includes token parsing/redaction, validation, idempotent issue, conflict rejection, mismatch preservation, single-use redemption, 16-way concurrent redemption, cancellation, expiry, unlocked payload drop, replay tombstones, and purge
• cargo clippy -p smg --lib -- -D warnings -A clippy::allow-attributes -A clippy::ignored-unit-patterns
  • clean with the two unrelated allowances required by the current prod baseline

Checklist

• cargo +nightly fmt passes
• strict package clippy passes with documented current-base allowances
• full SMG library tests pass
• No runtime documentation change is needed because the module is unwired