Enforce the Devii task quotas with atomic reservations

The creation and run quotas were checked and then acted on, so two concurrent
create_task calls or two schedulers could both pass the check and overshoot the
limit. Both are now a single conditional INSERT decided on the driver rowcount:
reserve_run takes a run slot after the claim and releases the claim by deferring
when the quota is spent, and insert_task_within_quota does the same for the task
row itself. Racing twelve and sixteen processes now yields exactly the limit.

The atomic insert names its columns, and dataset skips a None valued key when it
creates a table lazily, so the store declares the full task column set up front.
Both the column and index ensures now tolerate a concurrent duplicate, since
several processes build a store at once and SQLite DDL is not idempotent.

Adds the quota, task-run context, guard, store and scheduler test suites, and
documents the chokepoints and the unhackable task-run flag.

tests/unit/services/devii/actions/catalog.py

@@ -14,10 +14,7 @@ def _records_mutation(name: str) -> bool:
     return action.method in MUTATING_METHODS and not action.is_read_only
 
 
-def test_read_only_query_tools_are_marked_read_only():
-    # These are POST routes (they carry a body) but only read data. They MUST be
-    # read-only so they do not trip the agentic plan gate or the verification gate
-    # and drop the rows the user asked for.
+def test_post_query_tools_are_read_only_so_the_plan_gate_keeps_their_rows():
     for name in ("db_query", "db_design_query"):
         assert BY_NAME[name].is_read_only is True
         assert _records_mutation(name) is False
@@ -146,8 +143,7 @@ def test_scheduling_tools_are_hidden_from_guests():
     from devplacepy.services.devii.registry import CATALOG
 
     guest = {
-        s["function"]["name"]
-        for s in CATALOG.tool_schemas_for(authenticated=False)
+        s["function"]["name"] for s in CATALOG.tool_schemas_for(authenticated=False)
     }
     for name in ("create_task", "update_task", "run_task_now"):
         assert name not in guest