Bound concurrent transaction_mode => 'new' launches

[Copilot]

df.start(..., transaction_mode => 'new') opened an extra loopback backend per caller with no cross-session cap, so bursty submissions could drive backend growth toward max_connections. This change adds database-wide admission control, bounded rejection, and explicit coverage/documentation for the supported concurrency envelope.

• Admission control for 'new' launches

  • Adds a cluster-wide cap on concurrent loopback launch sessions before the extra connection is opened.
  • Uses session-level advisory-lock slots so the limit applies across PostgreSQL backends, not just within one process.
  • Introduces:
    • pg_durable.max_new_transaction_starts (default 2)
    • pg_durable.new_transaction_start_timeout (default 5s)

• Sharper failure modes and diagnostics

  • Rejected launches now fail with an actionable admission-timeout error that includes the configured limit and wait duration.
  • Loopback-session failures are distinguished from admission failures:
    • connection/open failure
    • lock_timeout
    • statement_timeout
  • Tags loopback launch sessions with a dedicated application_name to make them identifiable in backend inspection.

• No partial state on rejected launches

  • Admission happens before opening the loopback session, so timed-out/rejected 'new' launches do not leave behind partial df.instances, df.nodes, or runnable engine state.
  • transaction_mode => 'caller' behavior remains unchanged.

• Concurrency coverage

  • Adds a multi-session E2E test that launches concurrent 'new' starts via separate PostgreSQL client sessions and proves:
    • the configured launch cap is not exceeded
    • excess callers time out with the expected error
    • rejected launches leave no persisted instance rows or orphaned work

• Docs / operating envelope

  • Documents the new launch budget separately from worker SQL-execution capacity.
  • Updates the connection-budget guidance and reinforces that per-row / high-fan-out call sites remain unsafe unless validated against the configured cap.

-- New admission-control knobs for transaction_mode => 'new'
pg_durable.max_new_transaction_starts = 2
pg_durable.new_transaction_start_timeout = 5

SELECT df.start(
  'SELECT 1',
  'audit-launch',
  NULL,
  'new'
);

• Fixes Bound concurrent transaction_mode => 'new' launches #314