Bound simulation catch-up and apply departure backpressure

[A-BenLi06]

Summary

Prevent an overloaded simulation from amplifying its own backlog, and stop depots from dispatching additional vehicles into an already occupied or jammed route.

Catch-up control

• Limit one scheduler invocation to five one-second simulation slices.
• If the worker is still behind, advance the simulation clock explicitly instead of looping without a bound.
• Shift each active vehicle's last-movement timestamp by the skipped duration so load shedding alone does not create false jam reports.
• For gaps over one hour, retain the existing vehicle clear but replay only the bounded five-second window rather than up to 3,600 slices.
• Emit a warning containing the skipped duration and budget.

This is intentional overload degradation: elapsed service is skipped so the simulation thread can return to its scheduler and recover.

Departure admission

• Check previous/current/next route jam state before startup.
• Check the current occupancy snapshots for the deployment segment and vehicle clearance.
• Write a successful deployment into the current snapshot immediately, making it visible to later sidings in the same tick.
• Hand jam state across one tick so siding iteration order cannot hide a jam.
• Include the first path segment in occupancy publication (index >= 0).

Validation

• Added blocked-deployment and immediate-reservation tests.
• Updated the route-jam lifecycle test to verify exactly one handoff tick.
• ./gradlew test --no-daemon
• Full suite passed (113 tests).

Part of #32.