fix(schedule): bound per-node re-dispatch and surface a loud CapErr (#828)

[buroa]

Summary

This is the Exit-B safety net for #828 - it converts a silent hang into a
loud, attributable failure, and is not a fix for the underlying determinism
defect. #828's core determinism requirement stays open as an approved follow-up
(see Scope below).

A schedulable node whose emitted content is non-deterministic across concurrent
re-runs feeds an unbounded scheduler re-dispatch storm, so Scheduler.Run never
reaches its inFlight == 0 fixpoint and hangs silently.

What this changes

• Per-node re-dispatch cap (pkg/schedule/schedule.go): a cumulative
  dispatchCount enforced at the single Run dispatch chokepoint. Past
  capLimit = 32 + 4*len(nodes) the node is force-terminalized and latched
  capped, so no path (OnArrival re-admission, the fixpoint rerun sweep) can
  reopen the storm. The scheduler gains no store handle and Run's signature is
  unchanged.
• Loud, attributable surfacing (CapErr() + pkg/orchestrator/dagrun.go):
  an additive Scheduler.CapErr() accessor reports the capped node ids and
  counts after Run returns; runDAG folds it into its returned error via
  errors.Join, so a recurrence surfaces as an errored run naming the offending
  node instead of a hang.
• Tests (pkg/schedule/schedule_test.go):
  TestSchedulerCapFiresOnPathologicalNode drives the real OnArrival
  re-dispatch seam past the cap (a gated keepalive holds the pool non-idle so
  the assertion cannot pass vacuously) and asserts Run returns with CapErr
  naming the node; TestSchedulerCapNoFalsePositiveOnConvergingDAG proves a
  converging large DAG does not trip the cap.

Net diff: 3 files, +247/-5 (pkg/schedule/schedule.go,
pkg/orchestrator/dagrun.go, pkg/schedule/schedule_test.go).

Scope: what this does NOT do

This does not close #828. It ships only the load-bearing p1 safety net
(Change A). Every-run convergence and byte-identical parallel output depend on
eliminating the still-unidentified non-deterministic schedulable emit (Change
B), which - together with its -race red->green reproduction - is blocked on a
cgo + fetched-chart -race environment and is tracked as an approved follow-up.

Requirement	Status
R1 - Parallel reconcile converges every run; dispatch workers stay bounded	deferred (Change B follow-up)
R2 - Parallel output byte-identical to --concurrency 1; non-deterministic emit eliminated	deferred (Change B follow-up)
R3 - Serial / already-converging topologies unchanged (no regression)	covered
R4 - A test reproduces the concurrency-gated non-determinism and guards the regression	deferred (Change B follow-up)

Limitations

• -race was not run (no cgo toolchain in the build environment). The
  offline suite is race-clean by construction (CapErr() and the test fakes'
  concurrent signals are mutex-guarded); a -race run on pkg/schedule remains
  the backstop on a cgo-capable runner.
• The tests guard the safety net, not the defect. They exercise the cap
  firing through the real re-dispatch seam, not the underlying non-determinism,
  which the follow-up still owes.

Refs #828. Please keep #828 open - this PR does not deliver its determinism
guarantee.

---

_{Draft opened by an autonomous Gas City github-issue-fix run
(workflow root fl-oku; triage: reproduced, p1). This is a draft: it
is the Exit-B Change A safety net, not a complete fix. Review the framing above
before promoting or merging.}