Scaling protection — maxConcurrentRuns

Add a configurable limit on concurrent AgentRuns to prevent cluster resource exhaustion.

## Design (per ADR 0006)

- Configurable `maxConcurrentRuns` on the controller (global and/or per-namespace)
- Runs beyond the limit remain in `Pending` phase until a slot opens (queue, not reject)
- Kubernetes `ResourceQuota` remains the primary hard protection against resource exhaustion; `maxConcurrentRuns` provides a better UX (runs queue rather than fail)

## Controller behavior

- Before creating a Sandbox, the controller counts running AgentRuns
- If at or above the limit, the run stays in `Pending`
- When a running AgentRun reaches terminal state, the controller picks the next `Pending` run (FIFO)
- Pending runs can still be cancelled (see #65)

## Future

- Kueue integration for sophisticated multi-tenant quota management (per-namespace, per-team, borrowing/preemption) is the long-term path if needed

## References

- ADR 0006: Hub addon pattern for agent resources
- Enhancement: [konveyor/enhancements#295](https://github.com/konveyor/enhancements/pull/295) — Scaling protection section

Start by reading ADR 0006 and locating the AgentRun controller reconciliation path in this repository. Trace how running and Pending AgentRuns are counted and how terminal transitions trigger reconciliation; issue #65 provides the cancellation context. Done means configurable global or per-namespace limits, FIFO queuing without rejection, and tests covering slot release and pending cancellation.

Written by the indexing model from the issue text.