feat: default service-wide worker resource quota

[JairusSW]

Salvaged from the superseded wago-org/wago#240 — the only part of that PR not already in wago main via #232.

Problem

WorkerOptions bounds each individual worker (queue depth, payload, bytes), but nothing bounds the number of live workers. A guest could Spawn without end and exhaust host instances, goroutines, and foreign stacks. The core instance.manage maxInstances budget only caps this when the host explicitly grants it a budget; a plain grant leaves workers unbounded.

Change

Add WorkerLimits{MaxLiveWorkers, MaxQueueBytes} — a service-wide aggregate cap with sane defaults (64 live workers, 64 MiB summed queue reservation), applied automatically or overridden via workers.New(workers.WithLimits(...)).

• Spawn claims the quota before forking (so an over-limit spawn never allocates a managed instance) and returns ErrWorkerQuotaExceeded past the ceiling.
• The reservation is held until the worker goroutine finishes (after instance close + all exit observers), so a concurrent Spawn cannot exceed the ceiling during finalization.
• Complements — does not replace — the core instance.manage budget.

Tests

TestWorkerLimitsQuota covers the live-worker ceiling, aggregate queue-byte ceiling (overflow-safe), slot release, and closed-service rejection. go build, go vet, gofmt, and go test -race ./... all pass.

🤖 Generated with Claude Code