[1.0] Bound ready-work admission and global execution concurrency

The scheduler can create unbounded tasks, and context is constructed before the per-agent semaphore admits engine work. Agent concurrency limits therefore do not bound waiting tasks or their contexts.

Scope

• Add bounded admission for start-ready work and a process-wide active execution limit while retaining existing per-agent limits.
• Build context only after the execution slot is granted; ensure supported publish/timer/invoke paths cannot silently bypass the applicable limits.
• Define explicit wait/reject results for overload. Artifact persistence must not be confused with admission to processing.

Acceptance criteria

• A deterministic burst stays within configured ready-work and active-run limits.
• Instrumentation confirms context construction does not happen for work still waiting for execution admission.
• Overload is visible to callers and operators; cancellation/shutdown releases capacity without silently losing admitted work.

Boundaries

Incomplete AND/batch/join reference limits have a separate dependent ticket; distributed scheduling is deferred.

References

• src/flock/orchestrator/scheduler.py
• src/flock/core/orchestrator.py
• src/flock/core/agent.py

Start by reading src/flock/orchestrator/scheduler.py, src/flock/core/orchestrator.py, and src/flock/core/agent.py to trace ready-work admission, context construction, and execution limits. Define the relevant wait or reject behavior and verify that supported publish, timer, and invoke paths honor the limits. Done means deterministic bursts stay within ready-work and active-run limits, waiting work does not construct contexts, overload is visible, and cancellation or shutdown releases capacity.