fix(runtime): harden HTTP API admission and offload

[doublewhy]

Plain-language summary

• Context: The runtime HTTP API must authenticate the intended target, reject oversized input before application buffering, and stay responsive while synchronous runtime work is slow.
• Problem: Bearer credentials were not consistently target-bound, request limits were enforced too late, and synchronous API work could occupy the event loop or retain unbounded pending work.
• Fix: Fail closed during authentication and request admission, offload synchronous calls through bounded workers, serialize target mutations, and isolate bounded rejection-audit writes.

Summary

• apply the same target binding to bearer and verified-proxy identities, reject unresolved bearer credentials without downgrade, and make configured identity maps immutable;
• enforce a single valid Content-Length plus streamed body limits at the public ASGI boundary before FastAPI route parsing or dispatch;
• move synchronous control-plane, backend, and store calls off the event loop, bound pending target mutations, and return stable 503 overload responses;
• isolate request-rejection audit persistence behind a dedicated one-worker limiter with bounded pending work while preserving stable 400/413 rejection if audit persistence fails;
• document the single-process in-memory scheduling boundary and add authenticated concurrency, request-bound, failure-path, and regression coverage.

Issue mapping

Closes #1090

Closes #1091

Part of #1093

Related: #8

#1093 remains open: this PR does not implement durable queued-job redispatch/reconciliation, cancellation recovery, cross-target worker progress, or exactly-once backend submission.

Integration dependency

PR #1136 must merge first. Its durable lifecycle changes require HTTP requests to remain admitted through terminal commit, audit, and response preparation, and require queued mutations to drain or receive a deterministic 503 during shutdown. That integration is implemented and independently audited on a local staging branch, but is intentionally not pushed here until #1136 lands. This PR remains draft to prevent the unsafe merge order.

Verification

• Python 3.12 focused API/runtime/concurrency coverage: 133 passed.
• Async test-isolation regression with the MCP suite: 148 passed.
• Configured non-host regression suite: 6420 passed, 1 skipped; only the two existing /usr/bin/busybox-dependent test targets were excluded.
• Changed production coverage: 100% lines and 44/44 changed branches.
• Ruff 0.15.9 check and format: passed.
• Repository policy: passed. Requirement governance was configured to skip because Ground Control was unavailable.
• Canonical verifier: static/policy, contracts, and docs lanes passed; this macOS host cannot complete the BusyBox-dependent unit checks or the participant-opacity proof because /usr/bin/busybox and pinned Isabelle2025-2 are not installed.

Scope boundary

No durable-store, scheduler, timeout, release, schema, or version changes are included.

[Brad-Edwards]

Updated the branch to complete the two admission guarantees identified during review:

• Authentication now requires the configured identity target to exactly match the control-plane target; a missing target no longer acts as a wildcard.
• Accepted request bodies are coalesced into one replay message instead of retaining every ASGI transport message, and Content-Length accepts digits only. This keeps retained request state tied to the byte limit and avoids numeric parser ambiguity.

Focused bearer/proxy, empty-message, replay, and header-form regressions were added. The branch was synchronized with current dev. Local canonical verification passed: 6,911 unit tests, 59 integration tests with 2 environment skips, contracts, policy, lint, formal proof, documentation, and 91% combined coverage.