powerqueue v0.14.0

The stateful model now covers the whole daemon: several tasks sharing
slots, ledgers and rate limits through the real launch pass. It found one
scheduling bug, fixed here: a start that fails before the launch no longer
keeps its slot and its predicted budget for the rest of the pass.

Changed

• Testing: a whole-daemon model (scheduler/model.rs) runs random
  interleavings of launch passes, per-task calls, recorded usage, the
  scheduling pause and time against several tasks sharing slots, ledgers
  and rate-limit marks. Launches go through the real LaunchPlanner as
  launch_tasks drives it; the checks cover slots (never beyond
  max_concurrent), one hand-out per ready task per pass, the retry time
  of a throttled candidate, budget (every ledger a pass reserved on stays
  within the safety margin), bounded progress (no ready task left
  unconsidered while a slot is free) and independence from the order the
  store lists the tasks in.

Fixed

• A start that fails before the launch (worktree setup, repo.setup, the
  launcher) no longer uses up its slot and its predicted budget for the
  rest of the launch pass: the next candidate is tried in the same tick,
  as the planner documents. Found by the whole-daemon model. (A failure
  that hits every task, such as a missing repository, now crashes every
  ready task in one pass rather than one per tick; each still gets its
  backoff and max_attempts.)