feat: Support pod resources, scheduling, and priority in the worker pool CRD

**Problem**
WorkerPool only exposes spec.replicas and spec.ateomImage. The reconciler hard-codes the worker Pod template with no resources, priorityClassName, nodeSelector, affinity, or tolerations.

Worker pods therefore run as BestEffort / priority 0, are easily evicted under node pressure, and cannot be declaratively pinned to dedicated or larger nodes. This is awkward in mixed-workload or heterogeneous clusters, and it conflicts with docs/architecture.md, which describes WorkerPool as defining hardware shape.

Resume also picks a free worker at random (workflow_resume.go), with no awareness of node capacity.

**Impact**

1. Worker pods are among the first evicted during resource pressure
2. A terminated worker can leave actors stranded in RUNNING (related: #23)
3. No supported way to isolate workers or prefer certain nodes via the WorkerPool API
4. replicas means “warm slots”, not CPU capacity

**Proposal**
Add a template (or equivalent) field to WorkerPoolSpec so operators can configure at least:

- resources (requests/limits)
- priorityClassName
- nodeSelector, tolerations, affinity
- extra labels/annotations
Propagate these into the managed Deployment Pod template and document an example in docs/api-guide.md.

**Workaround today**
Manually patch the generated Deployment, or rely on cluster-level node pools/taints. Neither is reflected in the WorkerPool CR.