fix(pep): do not fall back on lane-capacity refusals in rescue races

[bojieli]

Problem

CI on windows-11-arm failed TestPooledFlowsRecoverThroughOneReplacementGeneration/auto after #92:

pool_recovery_test.go:154: successful shared QUIC recovery recorded 1 TCP fallbacks

Reproduced locally under CPU contention (GOMAXPROCS=1, ~25% flake), which surfaced four distinct issues, all rooted in how the new parallel rescue interacts with slow machines:

1. Capacity refusals fell through to fallback paths (the real bug). Under contention the sprayed racers win their rounds, so the pooled control JOIN arrives after the flow's lane ceiling is full. The resulting errLaneJoinCapacity was treated like any other failure: under --transport quic it fell back to an ordinary QUIC join (an extra dialBulkConn socket, breaking the test's socket ceiling), and under AUTO it triggered the TCP commit — which on localhost wins the race and hands the flow to TCP while a QUIC sibling already rescued it. A capacity refusal is a benign per-attempt outcome (usually a sibling already holds the lane); it now ends the attempt instead of falling back.

2. queqiao_fallbacks_total counted at commit, not handoff. In a rescue race the AUTO TCP commit can be cancelled after a QUIC sibling wins — the flow never touches TCP but the counter incremented. It's now counted when a TCP rescue lane is actually installed.

3. The stall watchdog queued signals behind in-flight rounds. A persistent stall re-signals every threshold interval (250ms floor); a signal queued during a multi-second round fired a redundant round the moment the first returned, before the fresh lane could prove itself. The watchdog now stays silent while a round is in flight (rescueInFlight), and the manager drains any signal queued just before the guard engaged.

4. The test itself needed watchdog isolation. It pins exact dial counts for the recovery it injects; on a slow runner the watchdog legitimately starts rounds of its own (a slow echo is a real stall to it), each opening sprayed dials the ceiling can't budget for. New disableStallWatchdogForTest hook, used by this test. Watchdog behavior remains covered by stallwatch_test.go.

Verification

• GOMAXPROCS=1 -count=30 clean for both subtests (previously ~25% flake)
• -race on the stall/grace/race/pool/isolation tests green
• Full internal/pep suite green
• Diagnosis was done by tracing every socket creation to its caller frame: the excess came from dialBulkConn (the capacity-fallback path), confirming root cause docs: live comparison against deployed proxies, and a deployment guide #1 before fixing