pool: exact dispatch redesign with stale worker and node fencing

[raphael]

Contract

Stacked on #82 (requires the generational stream lifecycle).

Dispatch admission, retry resolution, and start-event publication become one Redis linearization point with real MaxQueuedJobs admission (replacing approximate MAXLEN trimming that silently lost unread jobs) and durable generation-immutable terminal dispatch records; cross-node waiters re-read terminal records on every wake/timeout edge. Cleanup runs exclusively under persisted Redis-time leases; scheduler planning and transitions run under distributed ticker ownership with foreign-job protection; settlement is node-owned with retry/join semantics so a definitive outcome is never abandoned. WorkerTTL is generation-immutable via the manifest (pool format 7); staleness comparisons use Redis TIME.

Stale-process fencing happens at each mutation's own linearization point:

• A worker start claim re-verifies the worker's registration, the absence of a cleanup fence, and the admitted payload identity (DISPATCHIDENTITYMISMATCH is terminal — acked with the error, never redelivered).
• Graceful shutdown and stale-worker takeover share one requeue lease: a stopping worker self-acquires the same Redis-time capability cleanup uses (atomically deactivating its registration) and republishes through the shared lease-fenced stable publication records, so exactly one party requeues each job and an interrupted graceful requeue is finished by takeover after lease expiry.
• Job dispatch and every scheduler transition/ownership script re-check the dispatching node's keep-alive registration and node-cleanup field (nodeLivenessFenceLua), closing the window between heartbeat preflight and mutation.
• Cleanup deletes legacy dispatch-map keys so adopted deployments retain no stale metadata after generation cleanup.

Acceptance

• Full repo go test ./... -race against live Redis: green at this tip.
• Fault injection: worker paused past TTL claiming after takeover (TestStaleWorkerCannotClaimAfterCleanupFence), graceful/takeover lease arbitration incl. expired-lease recovery (TestGracefulRequeueLeaseArbitratesWithCleanup), stale node dispatching/scheduling after node cleanup (TestStaleNodeCannotDispatchOrScheduleAfterCleanup), heartbeat/cleanup linearization, requeue dedup across owners.
• Diff-scoped review completed; both findings (dual requeue ownership, identity-mismatch classification) fixed in the follow-up commit.

Known residual, noted not blocking: DISPATCHLOST/POOLGENERATIONLOST claim failures keep their pre-existing requeue classification; revisiting that is backlog.