Add standalone compute pool service integration

[AlyciaBHZ]

Summary

• add a standalone compute-pool-service integration instead of a NyxID core-native compute API
• provide a reference worker-pull queue service, trusted worker bridge, and OpenAPI spec for the consumer API
• document how to register the service through existing NyxID service + Credential Node flows

Architecture

NyxID remains the control plane: org/agent auth, service governance, credential injection, node routing, proxying, and audit metadata. Compute-specific task state, worker tokens, local model endpoints, and GPU worker protocol stay in the external service.

This PR is not a NyxID service-pool framework. Cross-service counting, quotas, metering, and load balancing should be handled by a future generic NyxID service-pool design rather than by a compute-specific core API. The compute service exposes /v1/status as a capacity signal that such a layer could use later.

Security boundary

• no NyxID backend /api/v1/compute routes or compute collections
• no NyxID org model changes
• NyxID does not SSH into worker hosts or execute shell commands
• worker-local endpoint URLs and backend tokens are not stored in NyxID
• with Credential Node routing, the compute service API token can stay on the node host

Tests

• node --check integrations/compute-pool-service/server.mjs
• node --check integrations/compute-pool-service/worker.mjs

Notes

This replaces the closed prototype PR #967 direction. The old PR proved the worker-pull UX and safety boundary, but this PR keeps compute as a NyxID-managed external service rather than adding compute as a core backend feature.

[github-actions]

📊 Code coverage

No coverage components ran for this PR.

[AlyciaBHZ]

Addressed the two robustness notes that are most relevant before real concurrent traffic:

• Serialized JSON store writes through a process-local save queue and unique per-write tmp file, so concurrent requests in one process no longer race on the same tmp path.
• Made worker ack failures retryable. Transient /worker/ack errors no longer immediately fail the task; after --max-ack-failures consecutive failures, the worker aborts the local request and reports failure so compute is not orphaned.

Also tightened the docs/spec items:

• Documented the lease/ack relationship and the single consumer token task-visibility boundary.
• Updated OpenAPI server URL to 127.0.0.1 and added the 409 task_terminal cancel response.
• Re-ran node --check for server.mjs and worker.mjs, plus git diff --check.

Leaving functional state-machine tests and durable storage as follow-up work for when this reference integration grows beyond the smoke-test JSON backend.