perf(queue): 限制大媒体任务内存并消除准入惊群

将同步与异步非文本任务的准入唤醒改为按任务和全局队首推进，批量续租等待者，避免大量请求同时争抢 advisory lock 和数据库连接。

对 Base64 请求解析、素材解码、上游媒体执行和结果物化增加分层并发限制，复用请求素材并释放重复 Gemini wire 数据；生产 API 默认入口解析并发 16，媒体物化并发 8。

新增 1000 个同步 Gemini 图像编辑请求的模拟上游压力验收，10 MiB 输入和输出下全部成功，Heap 峰值增长约 2.58 GiB，并验证共享上传哈希、单次 attempt 与本地零落盘。

验证：go test ./... -count=1；go vet ./...；gofmt -l 无输出；kubectl kustomize deploy/kubernetes/production；10 MiB Gemini Base64 千任务压力测试通过。

apps/api/internal/runner/service.go

@@ -40,8 +40,11 @@ type Service struct {
 	asyncCapacityLoader  func(context.Context, int) (store.AsyncWorkerCapacitySnapshot, error)
 	admissionWakeMu      sync.Mutex
 	admissionWake        chan struct{}
+	asyncAdmissionWake   chan struct{}
+	admissionTaskWaiters map[string]*admissionTaskWaiter
 	admissionListener    sync.Once
 	asyncClientFactory   func(int) (asyncExecutionClient, error)
+	mediaResultSlots     chan struct{}
 	billingMetrics       billingMetricsObserver
 }
 
@@ -93,6 +96,9 @@ func New(cfg config.Config, db *store.Store, logger *slog.Logger, observers ...b
 	if cfg.AsyncWorkerRefreshIntervalSeconds == 0 {
 		cfg.AsyncWorkerRefreshIntervalSeconds = 5
 	}
+	if cfg.MediaMaterializationConcurrency == 0 {
+		cfg.MediaMaterializationConcurrency = 8
+	}
 	if cfg.TaskProgressCallbackTimeoutMS == 0 {
 		cfg.TaskProgressCallbackTimeoutMS = 5000
 	}
@@ -139,9 +145,12 @@ func New(cfg config.Config, db *store.Store, logger *slog.Logger, observers ...b
 			"universal":             clients.UniversalClient{HTTPClient: httpClients.none, ScriptExecutor: scriptExecutor},
 			"simulation":            clients.SimulationClient{},
 		},
-		httpClients:      httpClients,
-		workerInstanceID: asyncWorkerID(),
-		admissionWake:    make(chan struct{}),
+		httpClients:          httpClients,
+		workerInstanceID:     asyncWorkerID(),
+		admissionWake:        make(chan struct{}, 4096),
+		asyncAdmissionWake:   make(chan struct{}, 1),
+		admissionTaskWaiters: map[string]*admissionTaskWaiter{},
+		mediaResultSlots:     make(chan struct{}, cfg.MediaMaterializationConcurrency),
 	}
 	if len(observers) > 0 {
 		service.billingMetrics = observers[0]
@@ -539,7 +548,11 @@ func (s *Service) executeWithToken(ctx context.Context, task store.GatewayTask,
 			var admissionResult store.TaskAdmissionResult
 			var admissionErr error
 			if task.AsyncMode {
-				admissionResult, admissionErr = s.tryTaskAdmission(ctx, task, plan, "")
+				var alreadyAdmitted bool
+				admissionResult, alreadyAdmitted, admissionErr = s.activeAsyncTaskAdmission(ctx, task, plan)
+				if admissionErr == nil && !alreadyAdmitted {
+					admissionResult, admissionErr = s.tryTaskAdmission(ctx, task, plan, "")
+				}
 				if admissionErr == nil && !admissionResult.Admitted {
 					_ = s.store.ReleaseTaskPreparation(context.WithoutCancel(ctx), task.ID, task.ExecutionToken)
 					return Result{Task: task, Output: task.Result}, &TaskQueuedError{Delay: time.Second}
@@ -1272,6 +1285,15 @@ func (s *Service) runCandidate(
 		})
 		return clients.Response{}, err
 	}
+	mediaSlotPreacquired := mediaTaskNeedsPreUpstreamMaterializationSlot(candidate.ModelType)
+	releaseMediaSlot := func() {}
+	if mediaSlotPreacquired {
+		releaseMediaSlot, err = s.acquireMediaMaterializationSlot(ctx)
+		if err != nil {
+			return clients.Response{}, err
+		}
+		defer releaseMediaSlot()
+	}
 	providerBody, err = s.hydrateProviderRequestAssets(ctx, providerBody, candidate)
 	if err != nil {
 		_ = s.store.FinishTaskAttempt(ctx, store.FinishTaskAttemptInput{
@@ -1465,6 +1487,21 @@ func (s *Service) runCandidate(
 		}
 		return clients.Response{}, err
 	}
+	if task.AsyncMode {
+		// Async callers consume the canonical task result through the task API,
+		// never the original provider wire response. Release the raw JSON before
+		// decoding/uploading inline media so a large Base64 response is not held
+		// twice during the most memory-intensive phase.
+		response.Wire = nil
+		submissionWire = nil
+	}
+	if !mediaSlotPreacquired {
+		releaseMediaSlot, err = s.acquireMediaResultSlot(ctx, response.Result)
+		if err != nil {
+			return clients.Response{}, err
+		}
+		defer releaseMediaSlot()
+	}
 	uploadedResult, err := s.uploadGeneratedAssets(ctx, task.ID, task.Kind, response.Result)
 	if err != nil {
 		metrics := mergeMetrics(taskMetrics(task, user, body, candidate, response, simulated), parameterPreprocessingMetrics(preprocessing), map[string]any{