fix(ai): settle evicted PR replies, bind limiters and audit queue in chat runtimes, map auth outages to 503 - #2443

🟢 Confidence 10/10 · safe to merge. Auth re-mapping and the abandoned-reply settle are pinned by tests; the DO building BoundAiClients.layer is the one hop only a deploy proves.
_{no findings · tests covered · risk high · 1/1 new units observable}

Fixes evicted PR reply turns, binds limiters/audit queue into the Durable Object runtimes, and maps an auth outage to 503; the rest is comment and instruction cleanup. Safe to merge; neither open error issue is addressed — http-graph.ts and registry.ts changed only an import and comments.

• An evicted reply turn is settled through settleAbandonedTurn instead of left running
• ChatSession hands aiSessionPorts to the turn and approval runtimes
• An auth provider outage answers 503 on /mcp and the chat routes
• Uptime tools read time_zone, maintenance windows start_time_of_day

Before merge

• Manual · Deploy a preview: the DO now builds BoundAiClients.layer, and only a deploy proves the bindings attach

Production impact

_{da8e7ed · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}