enforce provider admission before NIP-90 execution

[moneya]

Enforce provider admission controls before accepting or executing work

Fixes issue by adding a provider admission gate before accepted state, feedback processing, payment-required feedback, or local execution.

Previously, priced providers could still execute no-bid work because the payment_required branch only ran when a bid tag existed. Unpaid or invalid work could consume local provider compute.

Provider runtime now classifies each request before any expensive or externally visible provider work happens:

• Admit
• Drop(reason)
• Defer(reason)

What Changed

• Added provider admission policy in apps/pylon/src/nip90_runtime.rs.
• Added safe defaults:
  • max_inflight = 1
  • per_buyer_max_inflight = 1
• Added early drops for:
  • stale requests: stale_request
  • priced no-bid requests: missing_bid
  • underbid requests: bid_below_price_floor
• Added capacity defers for:
  • global inflight limit: max_inflight
  • per-buyer inflight limit: buyer_limit
• Added durable admission leases in apps/pylon/src/ledger.rs.
• Re-check admission against the latest durable store before claiming a lease.
• Updated provider tests so priced no-bid work is rejected before execution.
• Kept existing paid follow-up behavior for already payment_required jobs.

User And Performance Impact

Invalid work is now rejected at cheap policy cost instead of reaching local execution.

Expected impact:

• Fewer wasted provider executions.
• Less CPU/GPU time spent on unpaid or invalid work.
• Valid paid work is less likely to wait behind work that should be rejected.
• Provider reports now show clear drop/defer reasons.
• Local expensive execution is bounded by default.

Tests

Passed:

cargo fmt --check
cargo check -p pylon
cargo test -p pylon provider_admission -- --nocapture
cargo test -p pylon ledger -- --nocapture
cargo test -p pylon buyer -- --nocapture
cargo test -p pylon provider -- --nocapture
cargo test -p pylon nip90 -- --nocapture

Current selected test counts:

ledger: 8 passed
buyer: 10 passed
provider: 20 passed
nip90: 6 passed

Not fully green:

scripts/lint/touched-clippy-gate.sh

Still fails in this checkout due to existing unallowlisted warning debt:

apps/pylon-tui/src/lib.rs: 51 warning(s), not allowlisted
apps/pylon/src/lib.rs: 739 warning(s), not allowlisted
apps/pylon/src/wallet_runtime.rs: 42 warning(s), not allowlisted

## Files Changed

- apps/pylon/src/nip90_runtime.rs
- apps/pylon/src/ledger.rs
- apps/pylon/src/lib.rs