fix(reconciler): debounce pool scale_check before spawning new sessions

[austinborn]

Summary

• Adds a process-scoped per-template scale_check confirm window to the pool reconciler. Reconciler call sites now read the minimum count over the last N=3 samples instead of acting on the raw value, so a single-tick flap to a positive value can no longer drive a fresh pool spawn that has nothing to claim.
• The cold-start window (history smaller than N) passes the raw count through, so legitimate new demand still spawns on the first observation. Steady-state demand (every sample ≥ 1) is unchanged once the window is full — min over [1,1,1] is 1.
• Templates whose probe failed this tick (poolScaleCheckPartialTemplates) are pass-through: a probe failure (raw count = 0) is not a real observation of demand and must not poison the window. retainScaleCheckPartialPoolDesired continues to own session preservation across partial-failure ticks.

Motivation

The pathology this addresses: an operator observed a pool slot in a ~66s respawn loop. scale_check_count flipped 0 ↔ 1 in the reconciler trace, but external probes of the exact same bd ready --metadata-field gc.routed_to=<pool> --unassigned --exclude-type=epic --json --limit 0 | jq length always returned 0. Each transient 1 raised new-tier demand, a session bead was created, the session ran the work_query, found no claimable bead, and drained. ~170 ghost spawns in 4h on a single slot.

Whatever upstream cause briefly produced an unassigned routed bead inside one tick (most plausibly a release-and-restore round trip on the assignee within a single reconcile), the spawn loop is the symptom this PR collapses. The orphan-release path inside releaseOrphanedPoolAssignmentsWhenSnapshotsComplete already runs liveOpenSessionAssignmentExists against the live session label set (the protection introduced in PR gastownhall#1856 / commit e796e7d9), so pinning a release containing that fix wouldn't have changed behavior here — the loop has to be filtered downstream of demand observation.

What changed

• cmd/gc/pool_scale_check_debouncer.go (new) — singleton holding per-template ring buffer + the debouncePoolScaleCheckCounts entry point. Mutex-protected; tests can opt out (window=1) or opt in (window=3+) via setPoolScaleCheckDebouncerWindowForTesting.
• cmd/gc/pool_desired_state.go — adds ComputePoolDesiredStatesDebounced and ComputePoolDesiredStatesDebouncedTraced wrappers. The pure ComputePoolDesiredStates{,Traced} entry points are unchanged so existing tests of the compute kernel remain valid.
• cmd/gc/build_desired_state.go (1 site), cmd/gc/city_runtime.go (3 sites — beadReconcileTick fallback, controlDispatcherTick, loadDemandSnapshot), cmd/gc/cmd_start.go (1 site) — swap to the Debounced variants. These are every reconciler-driven path that consumes result.ScaleCheckCounts.
• cmd/gc/main_test.go — setPoolScaleCheckDebouncerWindowForTesting(1) in TestMain so existing single-call spawn assertions don't have to seed history. Debouncer-specific tests opt back in via withPoolScaleCheckDebouncerWindow(t, 3).
• cmd/gc/pool_scale_check_debouncer_test.go (new) — covers: cold-start pass-through, sustained demand, single-tick flap suppression (the canonical pathology), partial-template pass-through (and that partials don't poison the window), per-template isolation, window=1 is a no-op, and reset semantics.

Trade-offs

• Cold-start latency: zero — the first N-1 samples pass through.
• Steady-state new-demand latency: bounded by N × tick_interval. At the typical ~10–30s tick cadence, that's 30–90s before sustained new demand confirms. In-flight new-tier sessions from prior ticks continue to count as spent demand via poolInFlightNewRequests during this wait, so the slot doesn't sit idle.
• Window is hard-coded at N=3. Operators who want to tune it can layer a [daemon] config knob in a follow-up PR.

Test plan

• Targeted: go test ./cmd/gc/ -run 'TestPoolScaleCheckDebouncer' -count=1 — six new tests, all pass.
• Pool / reconciler regression sweep: go test ./cmd/gc/ -run 'TestComputePoolDesiredStates|TestComputeAwakeSet|TestRetainScaleCheckPartial|TestBuildDesiredState|TestSessionReconciler|TestReleaseOrphaned' -count=1 — all pass.
• Full package: go test ./cmd/gc/... -count=1 -timeout 600s. Two failures (TestRunStartDriftCheck_RestartReturnsContinue, TestDoStartJSONAlreadyRunningSupervisorKeepsStdoutJSONOnly/drift_restart) reproduce identically on a clean origin/main (8028e93) — both expect /proc/<pid>/exe to be readable, which doesn't exist on macOS. Pre-existing macOS-specific, unrelated to this PR.
• Field validation: install the binary, restart the supervisor that's hosting the looping slot, watch the slot 2 spawn cadence go from ~66s to no recurring respawns within the first 1–2 min of steady-state.

---

Generated by the operator's software factory.
• City: `factory-main` · Agent: `local-core.builder-2`
• On behalf of: @austinborn