feat: add adaptive fill admission before I/O timeouts

[leiysky]

Summary

Slow background work previously continued accepting cache fills until staging saturated or the normal I/O deadline expired. Add optional pre-timeout fill control: Observe reports pressure and hypothetical rejections, while Adaptive limits new fills by encoded bytes and record count, pauses on stalled work, and resumes gradually after validation. The default remains disabled.

Reads, deletes, accepted writes, and essential reclaim retain their existing paths. Pressure is separate from terminal health. Snapshots expose request age, approximate drain time, phase durations, and admission counters; enabled snapshots take a short controller lock. Configuration, architecture, errors, and benchmark controls document the final contract.

Design Notes

A 100 ms monitor observes a fixed table of worker-owned background requests through admission, result consumption, and validation/publication. Request age and lack of validated progress can pause admission before the original timeout, including when no completion arrives. Configured byte/record budgets use bounded atomic reservations without foreground allocation, clock reads, or controller locks. Enabled modes account for one monitoring stack and their fixed observations. Accepted I/O is never resubmitted, and pressure suppresses optional reinsertion.

These are conservative workload-pressure signals, not a diagnosis of device failure or CPU throttling. Linux device/cgroup and io_uring qualification remains necessary.

Validation: cargo x check, cargo x test, and cargo x lint passed on macOS, including real blocked-backend pre-timeout detection, validation-gated recovery, continued reads/deletes, concurrent admission, and extended recovery tests. Fifteen alternating buffered benchmark runs passed; substantial host variability prevents a credible overhead percentage. A separate rate-limited run completed all writes and reads with expected admission rejections.