Contain overlapping SaaS tenant runtime execution

[AyobamiH]

Purpose

Contain D03 immediately while the larger immutable tenant/provider-context refactor is prepared.

The SaaS worker currently mutates process-global provider/model configuration inside withTenantRuntime. Cloudflare Worker isolates can interleave asynchronous requests, so overlapping cron or authenticated /tick drains could otherwise execute different tenant runtimes against the same mutable configuration and token-persistence callbacks.

This PR adds a bounded containment layer so only one SaaS job-drain execution can enter that mutable runtime at a time within a Worker isolate.

Changes

• Add a small exclusive async run gate for SaaS job-drain entry points.
• Route scheduled cron drains and authenticated /tick drains through the same per-isolate gate.
• Expose only active/waiting gate counts in /healthz for operational diagnosis.
• Add a deliberately interleaved two-tenant regression proving maximum concurrent execution is one.
• Verify a rejected run releases the gate and cannot poison the next run.
• Include the new regression in the complete CI gate.
• Record the repair boundary in docs/reliability-repair-progress.md.

Important boundary: containment, not D03 completion

This does not make withTenantRuntime safe by design and does not claim immutable provider clients. The underlying shared mutation still exists.

The follow-up D03 change must remove tenant-specific mutation of shared config and global token-persistence callbacks, and instead pass immutable tenant/connection context directly into OpenAI and provider operations.

This containment removes the immediate overlap race before that larger refactor lands.

Preserved boundaries

• No provider is re-enabled.
• Threads and Instagram hosted publication remain fail-closed.
• No Reddit connector ownership boundary changes.
• No billing, queue, publication-attempt, or schema semantics are changed.
• No deployment is performed by this PR.

Test intent

The new regression intentionally overlaps two logical tenant executions and asserts:

1. Only one execution enters the critical section at a time.
2. The second execution waits rather than overlapping.
3. Execution order remains deterministic.
4. A rejected execution releases ownership so later work can proceed.

The full repository CI remains the required merge gate.

Dependency / merge order

This branch was created from the exact green head of PR #2:

a73d1d9

Because PR #2 has not yet merged into main, GitHub currently shows PR #3 as containing both the PR #2 release-safety commits and the D03 containment commits.

Merge PR #2 first. After PR #2 lands, PR #3 should reduce to only the containment delta before it is considered for merge.

Current containment head:

ee37777