feat(desktop): add foreground publish admission scheduler

Publish is now treated as the runtime foreground channel and AI
monitoring as background. A new in-memory publish-scheduler owns queue
selection, per-platform active locks, and 3-6s post-completion platform
cooldowns.

The runtime controller tracks lease-in-flight per kind so a monitor
lease no longer blocks a publish lease, derives total concurrency from
hardware class, current process health, and an optional
GEO_DESKTOP_MAX_TOTAL_CONCURRENCY override, and reserves a publish slot
when budgeting monitor capacity. Monitor admission returns zero whenever
publish has backlog or an in-flight lease, so a cooldown-blocked publish
queue still prevents monitor from consuming the foreground reserve.
Runtime diagnostics expose publishScheduler alongside monitorScheduler.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/desktop-client/src/main/runtime-snapshot.ts

@@ -7,6 +7,7 @@ import { collectRecoverySnapshot } from "./crash-recovery";
 import { getKeepAlivePlan } from "./keep-alive";
 import { getLeaseManagerSnapshot } from "./lease-manager";
 import { getMonitorSchedulerSnapshot } from "./monitor-scheduler";
+import { getPublishSchedulerSnapshot } from "./publish-scheduler";
 import { getObservedRequestSnapshot } from "./network-observer";
 import { getHiddenPlaywrightSnapshot } from "./playwright-cdp";
 import { getRateLimiterSnapshot } from "./rate-limiter";
@@ -169,6 +170,7 @@ function createLiveRuntimeSnapshot(controller: ReturnType<typeof getRuntimeContr
         lastError: controller.lastError,
       },
       scheduler,
+      publishScheduler: getPublishSchedulerSnapshot(),
       monitorScheduler: getMonitorSchedulerSnapshot(),
       sessions,
       hotViews,