docs(design): bound io_uring bgid u16 namespace exhaustion (#2044)

[oferchen]

Summary

• Documents the 16-bit bgid namespace exposed by
  IORING_REGISTER_PBUF_RING (max 65 536 distinct provided-buffer
  rings per io_uring_fd).
• Captures the current state in crates/fast_io/src/io_uring/buffer_ring.rs:
  no central allocator, public bgid: u16 field defaulting to 0,
  no in-tree caller outside the unit tests in the same file.
• Proposes a free-list BgidAllocator with BgidLease, generation
  counter for defence-in-depth, and a typed BgidExhausted error so
  callers can fall back to non-PBUF_RING I/O at the hard cap.
• Cross-references the session-level ring pool design
  (docs/design/iouring-session-ring-pool.md) and the adaptive
  sizing audit (Align cross-compile matrix with build_daemon metadata #2045) as the orthogonal per-ring concern.

Why now

Today the namespace is unused because no in-tree caller constructs a
BufferRing outside its own unit tests. As soon as the session-pool
design or per-file PBUF_RING work lands, callers will start minting
bgid values. Without a recycler, a long-running daemon would hit
-EEXIST after 65 536 cumulative file transfers per io_uring fd
even though the live working set is tiny.

Doc

docs/design/io-uring-bgid-namespace.md - 434 lines, ten sections:
problem statement, current allocation policy, current safety net,
theoretical thresholds, realistic scenarios, recycler design, hard
cap and fallback, test strategy, cross-reference to #2045, open
questions.

Test plan

• grep -ni -E 'claude|internal|internal docs\.md' docs/design/io-uring-bgid-namespace.md returns empty.
• grep -nE '—|–' docs/design/io-uring-bgid-namespace.md returns empty.
• Markdown renders cleanly in the GitHub diff viewer.
• CI: docs-only change; expect fmt+clippy and nextest to be
  unaffected by the doc.