fix(pool): preserve capacity across replenishment races

[tisonkun]

Summary

• normalize pool-internal visibility and reexport organization
• keep replenishment reservations inside the bounded pool instead of adding pool-gated methods to Semaphore
• prevent concurrent replenishment, active objects, and in-flight creation from exceeding the pool maximum
• restore reserved capacity when replenishment fails or is cancelled
• document that targets above the maximum are clamped

Design Notes

replenish_to atomically drains only immediately available permits through the existing public Semaphore API. Because idle objects occupy pool slots without holding permits, it derives creation capacity from available permits plus its own reservation, minus the current idle count. Permits held by checkouts, in-flight creations, and concurrent replenishments therefore remain committed without serializing maintenance calls.

A private borrowed guard returns unused permits on success, error, or cancellation. Semaphore has no API surface conditioned on the unrelated pool feature.