Add flat policy surface and wire 9 per-tenant knobs

[scott-rc]

Phase 4 of the assignment-redesign plan. Tenants need per-deployment overrides for tunables (HPA tolerance, retry policy, heartbeat timeout, assign timeout, token TTL, scale targets) that currently live as cluster-wide flags. Add a flat, concern-prefixed policy surface on Assignment (scale_*, zone_*, assign_*, heartbeat_*, retry_*, transport_*) with reserved field-number ranges per concern, three enums (ZoneSpread, ZoneAffinity, Backpressure), and 29 resolver methods on *Assignment. Header validation rejects negative durations, inverted backoff bounds, zero on degenerate fields, and out-of-range scale tolerance.

Nine knobs are wired end-to-end through the controller's HPA scaling math, supervisor heartbeat-timeout / scale-to-zero, assignPod POST timeout + PASETO token TTL, and the router's RoundTrip retry loop. Decision sites accept the converge-tick *Assignment snapshot as a parameter so a tenant override applies uniformly across one tick. The five scale_* resolvers prefer flat with Scale fallback so an existing tenant header continues to work.

The remaining 15 placeholder knobs (transport_*, zone_*, assign_path, heartbeat_interval, retry_backpressure, retry_status_codes) validate and expose resolver methods but are not read by any decision site -- each followup plan wires its own.

Three telemetry keys (scale_target_cpu_millicores, scale_target_memory_mebibytes, scale_target_in_flight_requests) dual-emit alongside the legacy target_* keys; both report the flat-preferred-over-Scale resolved value so dashboards keying on either vocabulary observe identical series.

Stacked on top of #140 (Phase 3: CLI flags + Web UI routes). Plan: tmp/assignment-redesign/plan.md.

[scott-rc]

This change is part of the following stack:

• Rename Function to Assignment and dual-write K8s annotations #138
  • Dual-emit assignment vocabulary on header, metrics, and telemetry #139
    • Surface assignment vocabulary on CLI flags and Web UI routes #140
      • Add flat policy surface and wire 9 per-tenant knobs #141 ◀

_{Change managed by git-spice.}