Runtime: enforce per-resource thread and stack admission limits

Parent: #502 Depends on: #978, #979 Related: #480, #482, #492

Problem

The typed runtime boundary can observe thread pressure but cannot reject a concurrent spawn before OS-thread and configured-stack reservations exceed an embedder budget. Applying limits after std.Thread.spawn races and cannot provide deterministic backpressure.

Scope

• Add optional process-wide per-resource limits for admitted threads and configured stack bytes.
• Reserve both dimensions atomically before the OS spawn; release on spawn failure and thread exit.
• Expose current policy, reservations, and policy rejections in the public Zig resource snapshot.
• Preserve unlimited defaults and existing API-specific error mapping.

Acceptance

• Concurrent admissions never exceed either configured limit and rejected spawns create no OS thread.
• Spawn failure and normal exit release reservations exactly; lowering a limit below current use blocks only new admissions.
• Unlimited defaults preserve current lifecycle behavior.
• Focused normal and TSan pressure tests, production lifecycle tests, runtime-thread audit, full units, and docs pass.
• This controls thread/stack admission only; it does not claim runnable CPU-slot coordination.

Completed on main in cab1dd6. Per-resource process-wide thread and configured-stack admission limits now reserve atomically before OS spawn, reject without creating threads, and release on OS failure or thread exit. Defaults remain unlimited. Schema-v2 telemetry exposes active policy, reservations, and admission rejections. Validation: focused normal and TSan pressure tests, Worker and shared-realm Thread lifecycle tests, the 6/6 runtime thread audit, a 51-page docs build with manifest verification, and the full unit suite (2,495 passed, 1 skipped, 0 failed, 0 leaked). Flips 0 test262 cases.