Fix strict multimodal admission and retained HTTP workers

[ajroetker]

Summary

• add strict, pair-aware ClipClap GGUF admission while preserving fail-closed Gemma decoder/projector validation
• replace POSIX per-request Io.concurrent timeout races with one bounded, multiplexed deadline observer per listener
• centralize finite concurrency ceilings for every audited process-, database-, and storage-lifetime std.Io.Threaded owner, including provisioned reads/writes, backup fallbacks, Raft stores, native/lite storage, serverless S3, and LMDB
• expose timeout and observer metrics and wire cancellation-storm coverage into the default unit graph
• require the shipped Gemma multimodal E2E to execute successfully instead of accepting an unimplemented response

Validation

• exact current Gemma 4 E2B Q4_0 decoder + Q8_0 projector paired contract and native admission
• published antflydb/clipclap Q4_K pair contract, strict tensor-layout validation, canonical GGUF export, and native admission
• live native ClipClap text embedding smoke
• make generate and make zig-generated-check
• focused Debug suites: common HTTP observer/listener, serverless, LMDB, LSM backend, lite native, data storage, Raft, backup/storage authority, standalone runtime, API table reads, and API table writes
• final API table-read suite: 13 passed, 0 failed, 0 leaked
• final API table-write suite: 70 passed, 2 sandbox-only local-bind skips, 0 failed, 0 leaked
• zig fmt and git diff --check

The large-model CI smoke requires real Gemma image inference. Compatibility validation remains strict and fail-closed; ClipClap is validated as its own dual-model contract rather than being treated as a Gemma-style projector.