fix(queue): 隔离异步准入故障并持久化退避

将 X-Async 调度改为逐任务阻塞协议，区分全局容量、平台容量、用户组 FIFO、任务级异常和系统级故障，避免单个历史毒任务触发整批回滚。\n\n新增持久化退避、单任务 CAS 重选、幂等终态事务、固定标签指标和损坏快照自愈，并修复 Worker 从 preparing 直接进入 finalizing 时的自等待死锁。\n\n验证：API 全量测试、PostgreSQL 集成场景、race、go vet、govulncheck、pnpm lint/test/build、Compose 与发布脚本测试通过；pnpm audit 命中未改动的 Nx 工具链既有漏洞。

scripts/migration-safety-reviewed.json

@@ -45,6 +45,13 @@
         "DELETE FROM operation"
       ],
       "reason": "This one-time semantic migration takes a write-blocking/read-compatible lock, records count and SHA-256 manifests, archives every legacy allow row, verifies the archive, and only then deletes legacy allows. Deny rows are checksummed before cleanup and verified unchanged afterward. The procedural blocks make any count or checksum mismatch abort the transaction; reapplying after new whitelist writes also fails before deleting them."
+    },
+    "apps/api/migrations/0104_async_admission_dispatch_resilience.sql": {
+      "sha256": "e4585aedc97a1f3e38ac6256863306cfbf8aca6dff623c97bc0f846eb3ff1767",
+      "allowedViolations": [
+        "non-null column addition"
+      ],
+      "reason": "The dispatcher state columns use constant defaults on gateway_task_admissions, so PostgreSQL 18 can add them without rewriting the table and old binaries remain compatible. Production preflight on 2026-08-04 found 88 admission rows; the bounded nonnegative constraint validation and partial dispatch index are additive, and application rollback intentionally retains them."
     }
   }
 }