chore(freeze): name quota + epoch GC for `environment_freeze_epochs`

Problem

The last_unfrozen_at floor (from the "approval expiry pauses under freeze" work) is stored in
environment_freeze_epochs, keyed by (project_id, environment). Because freezes can be created for
arbitrary (even never-deployed) env names, the epochs table can grow with distinct names, and a naive GC
is hazardous — a wrong GC can shorten an in-flight approval window.

Proposed direction

• Quota on distinct freeze names per project, counting distinct names across active freezes ∪
  epochs (counting only active freezes would let you create names infinitely by unfreezing). Enforce
  atomically under a per-project lock (before the env lock; two concurrent creates near the limit could
  otherwise exceed it).
• Admin prune op for environment_freeze_epochs that avoids recreating the GC hazard:
  quota-lock → env Freeze-lock → confirm no active freeze for the env → DELETE conditioned on the
  observed last_unfrozen_at → refuse while any relevant gate's awaiting_since predates the epoch
  (conservative fallback: refuse if ANY gate is awaiting in the project). Otherwise hitting the quota
  permanently blocks new envs.
• Sweep performance: batch-load epochs only for the distinct envs present in the sweep's candidates
  (never all project epochs), cache by (project, env); only the authoritative in-tx re-read reads live.

Depends on: the environment_freeze_epochs table from "approval expiry pauses under freeze".

Baseline: origin/main. Low priority — slow growth is cheaper than a wrong GC. Verify line numbers
against current origin/main.

No files, tests, or entry points are named; begin from the current origin/main implementation of environment_freeze_epochs and the freeze and approval-expiry paths. Trace project and environment locking, sweep candidate loading, and gate awaiting_since checks before designing the quota and admin prune operation. Done means atomic quota enforcement, conservative deletion, candidate-scoped sweep loading, and tests proving in-flight approval windows cannot be shortened.