Bound request and discovery concurrency and share failed in-flight interpreter probes #539

Tracking plan: #528
Priority: P2. Evidence: source-confirmed unbounded fan-out; quantify scaling impact with #533 before selecting limits.

Problem

RPC handlers create an OS thread per request. Discovery creates additional scoped threads per workspace/search path, and Conda discovery creates per-environment workers. Refresh coalescing shares identical work but does not bound unrelated requests, waiting threads, or nested locator fan-out.

Interpreter resolution serializes by cache-entry mutex, but an unsuccessful probe is not published to its existing waiters as a shared result. A burst targeting one failing executable can repeatedly incur the same expensive timeout rather than share one attempt.

Sources: request handlers, path workers, Conda fan-out, probe cache locking, existing single-flight cache helper.

Scope

Introduce bounded request/discovery/process work using the simplest scheduler compatible with streaming results and current platform support. Avoid nested-pool deadlocks and avoid queueing one OS thread per blocked request. Define admission/backpressure, fairness, shutdown, and operation deadlines explicitly; an async-runtime migration is not a prerequisite.

Share the outcome of one in-flight interpreter probe with concurrent waiters, including failure, without permanently negative-caching an executable that may later become valid. Distinguish a caller's deadline from the lifetime of shared work.

Acceptance criteria

• Representative large inventories and request bursts remain within documented worker/process/queue bounds, measured by Benchmark long-lived PET sessions, real concurrent resolves, and inventory scaling #533.
• Same-key successful and failing probes execute once per in-flight group; later independent requests can retry failures.
• Different keys can progress concurrently; nested discovery cannot deadlock the scheduler.
• Lightweight control requests remain responsive during slow discovery; overload produces an explicit, documented outcome.
• Shutdown/cancellation does not leak children or leave refresh joiners permanently waiting.
• Locator priority, complete inventory, refresh coalescing, and early streaming remain correct, with no material small-workload latency regression under Gate client-observed refresh latency and define accurate first-environment timing #531.

Dependencies

Depends on #530 for safe probe lifecycle, #533 for measurable workload/resource bounds, and #536 for coherent request ownership. Coordinate with #535 so moving glob expansion off the dispatcher does not create unbounded traversal threads.