fix(worker): 隔离任务创建与队列恢复窗口

高媒体并发下，任务创建后的请求恢复和候选准入可能持续数十秒；通用 River 恢复扫描会在准入记录落库前误把新任务当成崩溃遗留任务，提前创建 Job 并占满 Worker 执行槽。\n\n为无活动 River Job 的通用兜底恢复增加 5 分钟新任务保护窗。正常提交、准入调度以及已有 River Job 的 Worker 强杀恢复保持原路径；新增 PostgreSQL 集成回归，验证新任务不被抢占且超过保护窗后仍可恢复。\n\n验证：Go 全量测试、go vet、runner/store race、gofmt、迁移安全检查通过。

apps/api/internal/store/admission_queue_integration_test.go

@@ -471,6 +471,36 @@ WHERE id = $1::uuid`, queuedAtomicTask.ID).Scan(&riverJobID, &queuedLeases); err
 			t.Fatal("generic River recovery claimed a task owned by the async admission dispatcher")
 		}
 	}
+	recoveryGraceTask := createTask(true)
+	recoverableTasks, err = first.ListRecoverableAsyncTasks(ctx, 1000)
+	if err != nil {
+		t.Fatalf("list fresh recoverable tasks: %v", err)
+	}
+	for _, item := range recoverableTasks {
+		if item.ID == recoveryGraceTask.ID {
+			t.Fatal("generic River recovery claimed a task still preparing admission")
+		}
+	}
+	if _, err := first.pool.Exec(ctx, `
+UPDATE gateway_tasks
+SET created_at = now() - interval '6 minutes'
+WHERE id = $1::uuid`, recoveryGraceTask.ID); err != nil {
+		t.Fatalf("age task beyond River recovery grace period: %v", err)
+	}
+	recoverableTasks, err = first.ListRecoverableAsyncTasks(ctx, 1000)
+	if err != nil {
+		t.Fatalf("list aged recoverable tasks: %v", err)
+	}
+	recoveryGraceFound := false
+	for _, item := range recoverableTasks {
+		if item.ID == recoveryGraceTask.ID {
+			recoveryGraceFound = true
+			break
+		}
+	}
+	if !recoveryGraceFound {
+		t.Fatal("generic River recovery did not claim a task beyond the recovery grace period")
+	}
 	result, err = second.TryTaskAdmission(ctx, inputFor(queuedAtomicTask, 100, ""))
 	if err != nil || !result.Admitted || len(result.Leases) != 1 {
 		t.Fatalf("worker-time queued admission result=%+v err=%v", result, err)