Govern Graphile cache and realtime lifecycles

[yyyyaaa]

Context

Part 3 of 6 in the draft tenant-density stack: #1654 → #1655 → #1656 (this PR) → #1657 → #1658 → #1659. It builds on the exact pool/notification primitives in #1654 and the plugin isolation work in #1655.

This is the hardened successor to the useful cache-pressure ideas in #1331. It keeps dedicated tenant/API instances and reduces peak/resident memory through bounded lifecycle control; it does not group tenants into a canonical Graphile instance or rewrite their SQL.

What changes

• Adds heap-aware cache admission, serialized/coalesced large builds, bounded draining, awaited disposal, timer cleanup, and stable refusal/readiness signals.
• Evicts and fully releases an instance before admitting replacement work under pressure, while already-resident handlers can continue serving.
• Adds shared realtime listener/manager lifecycles with explicit generations, cursor tracking, topic discovery, lease accounting, and WebSocket teardown.
• Preserves current-main's fail-closed pre-Grafast event gate and applies parameterized RLS visibility checks before throttling or delivery, avoiding a hidden-traffic timing side channel.
• Exposes lifecycle counters and diagnostics needed by the qualification harness rather than treating cache residency as inferred success.

Validation

• Frozen lockfile installation and package builds passed.
• graphile-cache passed 69/69 tests.
• graphile-realtime-subscriptions passed 140/140 tests.
• Focused server realtime integration passed 10/10 tests.

Why this remains a draft

The governor still needs a conservative instance-cost value from complete-customer runs; the measured single-surface heap result must not be copied directly into production capacity. Long-lived route/security revision invalidation also remains incomplete: #1658 hardens admission, but the final candidate still needs an atomic TenantSecurityContractV1 and authoritative WebSocket revocation before production.