Implement bounded native execution and one-writer-per-index coordination

[kylebernhardy]

Outcome

Run indexing, merging, commits, and search outside the JavaScript event loop and libuv pool with bounded admission and deterministic ownership.

Acceptance criteria

• Exactly one Tantivy IndexWriter exists per canonical storage identity, logical index, and generation.
• Independent indexes may ingest and search concurrently.
• Each writer uses bounded ingestion lanes and a serialized commit actor.
• Search uses a bounded package-owned pool.
• Queue depth, memory, merge, and concurrent-search limits are enforced process-wide.
• Cancellation distinguishes queued work from already-started non-cancelable native operations.
• Panic and worker failure transition the affected generation to a typed failed state.

Comment generated by kAIle (Codex GPT-5)