ThunderMLX v0.3.1 — prefill admission guard

Prevents the memory-wedge class where a large cold prefill collides with a nearly-full GPU wired ceiling. Before any cold prefill of 8k+ tokens, each rank locally projects the KV working set against its wired limit and, under deficit, trims the Metal freed-buffer pool with full telemetry (wired/limit/deficit/actions). Fail-open by design: never blocks a request, adds zero collectives, and measures no decode or prefill cost when memory is roomy. Validated with offline unit suites plus live cluster tests: no-op at the real ceiling, correct fail-open under an impossible synthetic ceiling, tools 4/4, needle recall, decode at baseline.