P1: add an in-memory resource queue scheduler

[novelKR]

Issue

Remaining P1 occupancy work (resource queue scheduler). No tracking issue.

Summary

Workspace occupancy now waits on an in-memory per-resource FIFO for request-owned patch and exec work. A live process still rejects overlapping apply_patch / exec_command immediately with WORKSPACE_BUSY. MCP read and find stay unlocked.

Contract changes

• LIVE_TOOLS names unchanged. No new MCP tools.
• WorkspaceSerializationInfo flags unchanged: live process holds the mutation lease, no parallel exec, read/find while a process is live, no patch while a process is live, conflict_error=WORKSPACE_BUSY.
• Public WORKSPACE_BUSY still means a live process owns the workspace. Overlapping request-owned mutations wait in FIFO order instead of failing.
• Occupancy remains memory-only. It is not a SQLite schema and is not keyed by thread.

Tests

Verified:

• cargo test -p codespace-store --offline — 39 passed, including FIFO order, process-held immediate busy, waiter cancel, SharedRead wait/no-barge, workspace isolation.
• cargo test -p codespace-server --lib --offline — 24 passed.
• cargo test -p codespace-server --test apply --offline — 2 passed, including concurrent apply_patch serializing without WORKSPACE_BUSY.
• cargo test -p codespace-server --test process --offline — 13 passed, including live shell still blocking patch/exec and LIVE_TOOLS unchanged.

Not re-run here: full workspace CI, e2e, security, recovery, UDS worker death.

Security scenarios

• Path escape, token logging, and workspace-root isolation are unchanged.
• read/find do not take SharedRead, so live-process non-exclusion for reads is preserved.
• Occupancy is not durable across restart. A live process still does not make MCP callers wait.

Out of scope

• Durable process recovery (restart_recovery=none).
• Path-level occupancy for apply_patch.
• Wiring MCP read/find to SharedRead.
• Thread-keyed queues or SQLite leases.
• Container/remote dispatch.