feat(core): a client can work jobs without standing for leader

[giraffesyo]

Summary

Config.NeverLead keeps a client out of leader elections. It still claims and works jobs from its queues like any other client, but never runs the leader's duties: rescue, retention and history maintenance, periodic jobs, and stream delivery.

The use case is a process that shares an install it should not run, for example a developer's local worker pointed at a shared development environment on a queue of its own. Without this option such a process can be elected leader and run rescue and retention for the whole install.

An install whose clients all set it has no leader, so nothing is rescued or pruned; the operations guide says so.

Testing

• TestNeverLeadClientWorksJobsWithoutLeading: a NeverLead client works a job, and no leader row appears over several leader intervals. A second, normal client becomes leader while the first stays a follower. With the change reverted the test fails (a NeverLead client became leader).
• Full suite with -race against Postgres 18, and golangci-lint, pass.

No SQL changed, and nothing on the insert, claim or finalize paths.

Checklist

• make check passes (core module lint and all tests run locally)
• No cryptography was added (tests run with GODEBUG=fips140=only)
• New or changed SQL in the claim, finalize, rescue or leader paths has a concurrency or chaos test (no SQL changed)
• Behavior changes are reflected in docs/PLAN.md