fix(optimizer): bound queued solves to one deadline

[frahlg]

Stack

This PR is based on #890 because it needs the same optimizer solve files. Review only the incremental diff. Retarget it to master after #890 lands.

What

• replace the native process transport's uninterruptible queue mutex with a context-aware gate
• include Unix worker queue time in the existing time_limit_s budget
• drop an expired queued request before it can run the solver
• carry one monotonic deadline through model build, shared/direct HiGHS, CVXPY, recourse, multistage, progressive hedging, retries and fallbacks
• make deadline errors bypass new solver and backend fallbacks
• classify direct HiGHS kTimeLimit as deadline expiry while keeping other non-optimal statuses as solver errors

Why

The worker could spend the full time limit on the service solve and then reset it for the economic solve. Requests abandoned by Core could also wait behind the global lock and run later, delaying fresh plans.

This bounds useful work to one budget and keeps expired queue entries out of the solver.

Part of #885.

Tests

• full optimizer suite — 112 passed
• go vet ./internal/mpc
• go test -race ./internal/mpc
• Core↔Python optimizer integration tests
• make verify
• pre-push make verify-all, including linux/arm64, linux/amd64 and windows/amd64 builds

Limits

The deadline is cooperative; this PR does not kill a native solver thread while it is running. Solver-native time limits bound active work.

The Unix worker counts its own queue wait in the worker budget. ProcessTransport drops context-expired waiters before write and Core's outer context still bounds the whole call, but its pre-write gate time is not encoded into the JSON budget. A transport-independent absolute timestamp needs a later contract field or payload stamping in the Core files currently owned by #734–#736.