Track in-flight work and add deploy-precheck state for O1.2.5 (B1) #810

O1.2.5 lets Anton deploy the API by hand without cutting a show. Right before a deploy, the host asks the API whether anything is still running. This ticket adds the state the API needs to answer that truthfully. It is work package B1 of the O1.2.5 contract.

The contract is the spec. This ticket only gives B1 its own claim:

• Contract v2: [O1.2] Remove the unsafe deployment trigger and bootstrap the gate #381 (comment)
• Dependency update: [O1.2] Remove the unsafe deployment trigger and bootstrap the gate #381 (comment)
• Claude's confirmation with three notes: [O1.2] Remove the unsafe deployment trigger and bootstrap the gate #381 (comment)

Already done: check-config in #745.

Done when:

• One RAII work tracker in AppState reports every background write. Spawned tasks carry it, with no moment where it reads zero. A test rejects new unclassified tokio::spawn sites.
• One route layer guards every upload route (init, chunk, file, finalize and single-step uploads), from entry to the last write.
• State accessors exist for every precheck field in the contract: active producer (including is_test), recording, finalization in progress (including leftovers on disk), pending uploads (RFC3339 expiry parsed in Rust), scheduler start in progress, catch-up pending (one eligibility function shared with the scheduler) and next scheduled start.
• Missing instrumentation never reads as idle. Unknown state means refuse.
• The contract's fixtures pass.

Parent: #381