Implement TaskAdmissionController lease boundary for async scheduler

[eric-tramel]

Priority Level

High

Epic: #645
Depends on: #646
Related: #641, #647, #649, #650, #654, #657
Target branch: epic/645-async-scheduling while the epic is active.

Source of Truth

Specification details live in PR #658 under plans/645/, especially task-admission.md, contracts.md, capacity-model.md, benchmark-plan.md, and issue-map.md. This issue tracks the implementation slice and gates only.

Implementation Scope

Implement the V1 scheduler task-admission lease boundary while preserving current policy behavior.

This issue owns:

• TaskAdmissionController, TaskAdmissionPolicy, TaskAdmissionLease, and plan-equivalent scheduler admission DTOs.
• Admission before worker spawn for scheduler-level resources.
• Release on success, retry, non-retryable failure, cancellation, shutdown, stale discard, and salvage paths.
• Root/from-scratch work and downstream work entering the same ready/admission path.
• Separation of ready ordering in FairTaskQueue from resource leasing/accounting in task admission.
• Provisional benchmark/evidence artifacts required by plans/645/benchmark-plan.md until Build async scheduling benchmark harness for admission and fairness work #649 productizes the harness.

This issue should not implement bounded borrowing or resource-vector policy; #650 and #651 own those follow-ups.

Quality Gates

• No worker is spawned before the scheduler task lease is acquired.
• Spawned workers no longer wait for scheduler-level LLM/task capacity after spawn.
• Fair queue ordering remains behavior-preserving for the V1 lease-only policy.
• Single-group and single-resource workloads remain live.
• Root/from-scratch dispatch no longer bypasses the ready/admission boundary.
• Exact-once lease release is covered for all terminal paths.
• Tests cover retry, failure, cancellation, shutdown, stale frontier, salvage, row-group/pre/post batch behavior, roots, and current fair behavior.
• Hidden-waiter proof can derive max(spawned_waiting_for_llm_lease) == 0.

Validation

Run async scheduler and fair queue test suites, make check, relevant end-to-end async engine/recipe validation, stale-term searches for removed wait-path names, and the provisional benchmark/evidence commands required by plans/645/benchmark-plan.md.