feat(torrent): bound aggregate payload file operations

[linroid]

Concurrent torrent sessions previously had no shared admission limit for payload-file handles. Add TorrentConfig.maxOpenPayloadFiles (default 32, range 1–128) and share a coroutine semaphore across every engine-owned piece store. Storage waits before dispatching blocking I/O and retains its permit until that operation returns, including cancellation and provider failure.

Part of #162, stacked on #168 (torrent-v2-01-baseline). Each store opens at most one payload handle at a time, so operation admission bounds aggregate payload handles, including boundary-piece sidecars. Journals/checkpoints and other process descriptors remain outside this ceiling; the resource-accounting document describes those limits and the remaining production-profile work.

Validation: 308 local torrent tests passed, both pinned independent-client conformance scenarios executed, and the native-runtime dependency guard passed. New regressions cover cancellation before storage admission, provider failures returning capacity to another torrent, and cancellation during a blocked provider call retaining capacity until I/O actually returns.

This does not make blocking providers cancellable or establish the pause/stop latency release gate.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T13:27:11.997435Z	f1a8568	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Test Results

  476 files  + 3    476 suites  +3   3m 51s ⏱️ +2s
2 325 tests + 7  2 325 ✅ + 7  0 💤 ±0  0 ❌ ±0 
2 939 runs  +13  2 939 ✅ +13  0 💤 ±0  0 ❌ ±0 

Results for commit f1a8568. ± Comparison against base commit 7d27103.

[linroid]

Superseded by #231 (Contracts, verification infrastructure and resource limits) in the consolidated eight-PR stack for #162.

The replacement preserves this PR's code and subsequent fixes; its description links the original head and review discussions. The only additional consolidation fix is the CI-discovered listener cancellation regression, documented on the replacement. All eight replacements have passed their required CI checks.

Closing without merging. This branch and its discussions remain available for reference. Review index: #162 (comment)