Fix worker start retry and pool return safety

[lite-tx]

What changed

• rebuild per-run worker queues, counters, and thread holders before retrying WorkerRuntime::start() after a partial thread-launch failure
• add a deterministic build-test-only thread-launch failpoint and real-PGMQ retry regression
• reserve every idle connection-pool return slot during construction so healthy lease return does not allocate in its noexcept path
• document the failure model and verification evidence

Why

A partial thread-launch failure closed every bounded local queue but restored started=false. A second start() was therefore accepted while dispatchers could no longer enqueue work. Separately, returning the first reusable connection could grow idle_; an allocation failure escaping the noexcept return path would terminate the process.

Impact

Applications may safely retry startup on the same runtime after thread creation fails. Healthy connection returns no longer perform vector growth during lease destruction.

Validation

• reproduced the worker retry failure before the lifecycle repair: 0/1
• Windows MSVC 19.41 Release static: 8/8 CTest entries
• Windows MSVC 19.41 Release shared: 8/8 CTest entries
• Linux GCC 13.4 ASan/UBSan unit executable: 14/14
• Linux GCC 13.4 ASan/UBSan real-PGMQ focused startup retry: 1/1
• git diff --check