perf(runtime): batch durable Cell enrollment

[forhappy]

New Cells already initialize SQLite and publish an authoritative root before serving. With bundle publication installed, the reference adapter then serializes five enrollment PUTs per Cell under the node catalog lock. A burst repeats that dependent object-store work for every Cell.

Add one epoch-owned, bounded enrollment worker and an optional NodeBundleAuthority::bind_batch hook. Up to eight ready activations share provisional/Open catalog publication while each Cell retains its original pin CAS. The reference adapter opts in. Individual callbacks keep their independent response timing, and oversized catalog or pin-metadata cohorts decline before enrollment writes so individually admissible Cells still progress. Accepted callbacks survive caller cancellation and join at epoch shutdown; existing metadata ceilings, fences, recovery obligations, formats and object paths remain intact.

Fresh measurements

Controlled local A/B diagnostics run both adapters in one Rust 1.97.0 test binary, using temporary SQLite and a fresh in-memory object store with per-call delay. Each small Cell initializes one counter plus runtime metadata. Full-path timings include catalog, owner, SQLite, initial root, enrollment and the first SQL read. Three fresh runs per setting provide 24 observations for each eight-Cell burst.

Per-call delay	Concurrent new Cells	Serial p50 / p95	Cohort p50 / p95
5 ms	8	351.5 / 639.3 ms	212.1 / 220.6 ms
20 ms	8	1,121.5 / 2,009.4 ms	640.7 / 665.6 ms

Eight already-ready enrollments use 12 PUTs instead of 40. Full eight-Cell creation uses two cohorts, reducing total PUTs from 96 to 72. Single-Cell operation counts are unchanged; its latency samples do not establish a consistent improvement. Warm leased reads add zero object-store operations, and every initialized root restores correctly. The shared workstation runs other workloads; provider/HTTP/three-VM capacity and ordinary write throughput retain their separate qualification requirements.

The creation analysis and 60 raw measurement records with source checksums include the command, scope, complete single-Cell results and percentile definition. Moving creation into a request handler preserves its durable cost; embeddings must allow bounded concurrency across different Cells to benefit.

Validation

• 319 node tests and 242 runtime integration tests pass, including partial/lost pin and selector replies, cross-application identity, cancellation/join ownership, and 4,000-row catalog admission with individual fallback.
• All seven generated-TLS authority tests and 16 ordinary SQL example tests pass; strict runtime/Axum all-target/all-feature Clippy, API docs, architecture/layout, documentation syntax/links and SQL/peer contracts pass.
• All 22 cookbook packages check with their locked dependencies; builder-service strict Clippy passes.
• All eight packaged crates build with cargo package --workspace --locked; CI provides the broad workspace/provider suites.

A separate prerequisite commit aligns the nested builder/cookbook/fuzz/native-probe SQLite locks with #79, repairing its existing locked-CI failures. The queued-renewal fixture also gets an explicitly older initial issue time to avoid a same-millisecond renewal race; its production 30-second advertisement lifetime, one-second local deadline, queued workload and assertions remain unchanged.