fix(index): coordinate publication between the worker and its supervisor

A worker resource limit is enforced by the supervisor, but only the worker
replaces the serving database, and it does so before the persistence
artifact export. A limit observed in that window stopped a worker that had
already published, and the response still said serving_index_preserved=true
while the previous index had been replaced.

Publication and resource termination now coordinate through a per-attempt
publication fence: a never-created path next to a reserved unique file in
the private worker directory, which both sides claim by creating it
exclusively (cbm_fopen "wbx": O_EXCL on POSIX, CREATE_NEW on Windows), so
exactly one of them can win.

- The worker claims it through a new pipeline publication gate that
  cbm_pipeline_run calls once, after the last pre-publication check and
  before the serving database is touched. Losing means the supervisor
  already stopped the attempt for a limit: the run aborts before
  publication and the previous generation stays in place.
- The supervisor claims it before it terminates the worker for a limit or
  a failed RSS probe. Losing means the worker already committed to
  publishing: the limit is no longer enforced for that attempt, which runs
  to completion, and index.supervisor.resource_limit_after_publication is
  logged instead. A claim that can be neither won nor lost is retried on
  the next poll rather than risk stopping a committed worker.
- At terminal the supervisor settles the fence into
  result.publication_committed. An unquiesced tree keeps the fence, so a
  surviving member can never publish after the report.

serving_index_preserved now describes the request, not only its last
attempt: a servable index existed when the request began, no attempt of
the request committed to publishing (an earlier attempt can publish and
then crash into recovery), and that index is still servable. The direct
path and the daemon job both fold every attempt into these request facts;
cbm_mcp_index_worker_resource_response takes them as a third argument, and
NULL claims nothing.

The fence path travels as an optional last pair of the exact worker grammar
(--index-worker-publish-fence), accepted by the worker argv parser and by
the daemon bootstrap role check, stripped by the CLI and installed by both
worker entries.

Limits stay opt-in: without index_max_rss_mb or index_max_duration_seconds
there is no fence, no extra argv, no claim and no extra database read.
Graph content is unchanged either way.

RED (c78c077a plus only the new end-to-end test): a FIFO at the artifact
temp path holds the real worker after the rename, and the duration clock
crosses its limit only once the serving database has been replaced. The
supervisor stops the worker there and answers resource_limit_exceeded with
serving_index_preserved=true over a replaced database. GREEN: the worker
claimed first, the supervisor logs the limit as not enforced, and the
released worker finishes and reports the published index.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

docs/INDEX_RESOURCE_LIMITS.md

@@ -58,6 +58,18 @@ terminal only after the tree is quiescent or a bounded containment failure is
 explicitly surfaced. Resource termination is not retried and does not
 quarantine a source file.
 
+A worker limit never stops a worker after it has started to publish. The
+supervisor enforces the limits, but only the worker replaces the serving
+database, so the two coordinate through a per-attempt publication claim that
+exactly one of them can win. The worker claims it immediately before it
+replaces the serving database; the supervisor claims it before it stops the
+worker for a limit. If the limit is reached first, the worker can no longer
+publish and the previous index stays untouched. If the worker claimed first,
+the limits no longer apply to that attempt: the new index is published and the
+rest of the attempt, including the persistence artifact export, runs to
+completion. The supervisor then logs `index.supervisor.resource_limit_after_publication`
+instead of stopping it. With both worker limits `off` there is no claim.
+
 If RSS is enabled and three consecutive probes cannot obtain any trustworthy
 tree measurement while the root worker is still running, CBM fails closed with
 `code=resource_probe_failed`. A probe is untrustworthy as soon as one member of
@@ -102,7 +114,10 @@ Worker limit failures use the same shape with `stage=worker`,
 `resource=rss_bytes` and `unit=bytes`, or `resource=duration_ms` and
 `unit=milliseconds`. RSS measurement failures use `code=resource_probe_failed`
 and omit `observed`, `limit`, and `unit` because no trustworthy observation was
-available.
+available. For a worker failure `serving_index_preserved` describes the whole
+request: it is true only when a servable index existed when the request began,
+no attempt of the request (including an earlier one that crashed and was
+recovered) claimed publication, and that index still serves.
 
 ## Trust and compatibility