fix: Add certified tier selection and serving admission

[buildingjoshbetter]

Adds two unused prerequisites for safe streamed tier switching: a process-wide serving admission guard and a database-only certified selection journal. The public manager and request paths are unchanged in this PR.

The serving guard admits concurrent readers, reentrant nested operations and explicitly reserved child work while draining for exclusive activation. It rejects stale, forged, foreign-process and conflicting-identity tokens. Cancellation and deadlines are checked before admission; they do not impose a hard return-time bound while condition cleanup reacquires its mutex.

The journal stores bounded, strictly validated intent and selected records in existing metadata. Final selection owns one writer transaction, verifies the current source and paired receipt, compares the selected job and expected generation, then publishes registry/model metadata and retires exactly that successful job marker together. Config acknowledgement is generation-fenced; an unacknowledged selection cannot be replaced. Config/runtime projection remains separate and is not claimed by a database commit. Existing binding/source APIs and prior assertions are retained.

Validation:

• Sequential GPUBox installed-wheel/full suites with native sqlite-vec and existing prepared/file-backed job flags enabled: combined 3,274 tests / 2,798 subtests; publication 3,142 tests / 2,153 subtests. Both exit 0 with 17 explicit skips, 3 deselections, no timeout and no OOM kill.
• Independent serving review: 54/54 probes. Independent journal review: 35/35, including actual source revision, paired receipt and final certification in in-memory SQLite. Native schema and pathname identity are explicitly outside those local probes.
• Preserved pre-fix evidence covers forged closed child tokens, inherited cancellation admission, single-attempt uncertain rollback, staged-generation inconsistency and pending config acknowledgement. No failed evidence or existing assertion was removed.
• Ruff, Python 3.10 syntax, exact local/manifest/remote hashes, diff, public commit identity and privacy checks passed.

Combined full log SHA256: df53642321ee03b6e601d3101d902866755d771052efffd79314df2cca388f2f.
Publication full log SHA256: 3081cef511d4f392c6507528205440a5fc23d8420ce6deb565e39e11fa8cabce.

Callers still must establish coherent old state, an inactive target, maintenance ownership and a drained serving boundary. Final paired certification scans the pair once under the writer; its large-corpus latency remains unmeasured. Same-thread lease lifecycle and explicit cleanup of never-admitted child reservations are required. Native file-descriptor association, ABA replacement, config/runtime atomicity, public bounded routing and production memory reduction remain unproven. The original Mac memory incident is not claimed fixed.

Refs #795 and #756. Stacked on #825. Draft only; no issue closure or release claim.