Pin separate cold-release budget for repository churn

[forhappy]

Summary

• Pin merged Cellule #25, separating demand-driven idle releases (32 in flight, 32 completions/s) from automatic pressure shedding (2/s), while retaining release safety checks.
• Rescan up to eight other idle candidates when a release preflight races a Cell transition; other release errors retain their recovery path.
• Add a bounded parallel verify --concurrency mode to the repository benchmark, with success and identity-mismatch tests. Document the 10,000-repository reference target, local diagnostics and explicit capacity limits.
• Run the ordinary RustFS provider-compatibility gate in CI; keep the non-sparse >5 GiB Git/LFS gate manual on a runner with at least 40 GiB free.

Local verification

• On the merged Cellule pin: 111 library tests, 15 residency tests, isolated backup integration, Clippy with warnings denied and formatting passed. The benchmark's seven Python tests pass.
• The local SQL-only RustFS idle gate covered every expected owner at 100, 500 and 1,000 active Cells in 10-second windows, and again at 1,000 active Cells for 30 seconds. Released-only windows and three sampled restores passed after fresh-workspace restarts.
• A debug 100-slot Canopy server seeded 10,000 identities (100 populated with two commits and 128-byte LFS fixtures) to a local RustFS provider without a seed failure. The seed took 3,763.348 seconds. Two complete four-worker sweeps matched all 10,000 identities; the second used an empty local workspace after graceful shutdown. Both sweeps passed stock-Git v0/v2 clone, exact Git/LFS hashes and strict fsck for all 100 populated repositories.
• First-window real-store workloads passed: Git v2 refs 300/300, stock-Git clone 30/30, incremental fetch 20/20, LFS download 90/90, LFS upload 60/60 and unique-branch push 30/30.
• Uniform metadata at 10/s over a 1,000-identity active set did not consistently pass: 530/600 and 596/600 on the original server, with 70 and 4 driver_busy arrivals. A fresh-workspace run passed 600/600 but had 858-ms scheduled p95. Targeted logs put repository transitions at 782-ms p95 and Directory lookup at 13-ms p95 in that window. The exact cause of the variable cold-transition slowdown remains open.
• An earlier debug in-memory 10,000-identity run also passed seed and same-process verification. Its first LFS download and push windows failed before passing reruns; both initial failures remain documented and unexplained.

Limits

• These are shared macOS/debug/local RustFS diagnostics, not qualification of the proposed 8-vCPU, 32-GiB Linux node with same-region object storage, 500/1,000 full Git/LFS resident Cells, two gateways, unclean takeover, large bodies or sustained mixed-client load.
• A local full suite with RUST_TEST_THREADS=2 had 92 multi-server tests pass and one backup test fail with Io(WouldBlock); that test passed alone. Full-suite reliability remains open.
• Current GitHub checks did not start because GitHub reported a payment/spending-limit issue; no test log exists. Local verification was prioritized before the final push. CI should be rerun when account billing permits.