feat(ingress): bounded webhook verifier pool and pre-authentication budgets

[iperev]

Stacked PR 24 — base: #78 (feat/adaptation-recommendations). Do not merge yet. Review only the top commit.

Context

A single process-wide lock let only one webhook be verified at a time. Concurrent deliveries got 503 and were lost unless REST recovery or an operator restored them (T10). Forged and valid back-channel logouts shared one bucket of 16 burst and 4 per second (F-06). This implements the reviewed design webhook-ingress-scheduling.md with no migration.

What changed

• Verifier pool: a no-queue pool of 4 permits per admission instance replaces the REQ-CI-RUNTIME-008 single-worker clause.
  • Each permit is held from before verification until the commit result, and is released on cancellation or deadline.
  • Saturation and a broken worker keep the existing 503.
  • Composition rejects fewer than 2 or more than 8 permits.
• Checks before the body is read: after the declared-length checks and before the path lease or body read, the webhook route checks:
  • content type and encoding (400);
  • exactly one canonical signature header (401);
  • a request bucket (200 burst, 50/s) and a declared-byte bucket (32 MiB, 8 MiB/s). A request with no declared length is charged 25 MiB.
  • Refusal returns the existing 503 "webhook ingestion overloaded". The token bucket is extracted from public_request_limits and reused.
• Webhook deadline: 8 s, or the global deadline if that is shorter.
• Back-channel logout budget: 64 burst, 32/s. Login start and callback keep 16/4. Key lookup still happens after the header-shape checks.
• Recheck rotation: recent and repair recheck claims visit due repository scopes in key order after one in-memory cursor per lane. Order within a scope is unchanged.
• Metrics: three new fixed-label series: ci_coordinator_webhook_admission_total{outcome}, ci_coordinator_public_request_limited_total{route_class}, and a permit-hold histogram (REQ-CI-RUNTIME-015).
• Ingestion contract: names who recovers each refused delivery.
• Records: requirements, Proofkit routes and bindings, owner docs and the ROADMAP CI-014 row are updated; the row stays open.

Expected result

• Up to 4 concurrent valid deliveries are claimed; the 5th gets the existing 503.
• Requests with invalid headers never read the body or use a token.
• Forged logouts within the budget do not block valid ones.
• One repository's backlog cannot hold up other scopes in its recheck lane.

Provisional owner decisions (2026-10-11):

• Design decisions 1–5.
• The startup connection-share check is not adopted. The background share is 22, so the required pool would be 30 against 16. Only the counted inventory (runtime/connection_shares.py) and its test ship; foreground contention stays a recorded residual for CI-069.

Non-claims: no capacity, cross-replica abuse control, valid-delivery capacity beyond the declared budgets, provider behaviour or deployment readiness. All budgets are declared and unmeasured (CI-069 measures them). Native unit, PostgreSQL and mutation tests run only in CI, at the exact head. CI-014 stays open.

Independent review: gpt-6-astra (xhigh); findings addressed or rejected with reasons in the single commit. Provisional owner decisions (2026-10-11) are labelled in the changed documents.