Fix sequential RSI monitoring and require cloud evaluation capacity

[w4ffl35]

Summary

A paired RSI proof registers its fixed-control arm before its self-hosted arm. The operations monitor now reports absent arms explicitly instead of rejecting this valid sequential state. Unknown or duplicate arms still fail closed, and both arms must be finished before terminal accounting can be reported as settled.

Cloud RSI admission now requires fresh worker capacity for both REMOTE_API inference jobs and CPU evaluation jobs before baseline work or campaign admission. Previously a cloud-only worker could leave the first CPU evaluation queued indefinitely. Documentation covers separate or combined workers. CPU evaluation runs code and tests; it does not run a local language model. The version is prepared for v1.9.9.

Closes #119. Closes #120.

Verification

• Typecheck passed.
• Focused PostgreSQL monitor, queue, campaign, and controller checks passed using an isolated database and object store.
• CLI/HTTP mock checks passed 9/9.
• Actual restricted-role monitor fault checks passed for worker/lease loss, database outage and recovery, stalls, cancellation teardown, invalid billing, monitor restart after SIGKILL, stale-heartbeat recovery, bounded restart exhaustion, and unchanged durable accounting during recovery.
• All 248 local test files passed with PostgreSQL and object storage enabled; 211 reported TAP checks passed with zero reported TAP skips.
• Both exact-head hosted CI runs passed all 248 files and 9/9 CLI/HTTP mock checks; each hosted run skipped 41 optional database checks.
• Local package contents, version 1.9.9 and both actual packaged launchers passed. The package is 1,279,972 bytes; official distribution verification follows the tag workflow.

The controller integration fixture was supplied its 59 pinned historical benchmark objects. Earlier qualification failures from the missing objects and insufficient scratch-directory permissions are retained privately; the corrected runs changed the environment without changing source. No local inference or GPU testing was performed.

Security impact

The monitor remains read-only and retains all lease and accounting failure checks. Admission checks add an early refusal for missing worker classes without changing inference budgets, provider restrictions, or product GPU capability.

Test plan

Run npm run typecheck and npm test. Enable the optional PostgreSQL/S3 and isolated monitor test database variables to exercise the database checks; hosted CI runs these optional tests only when configured. Run bash scripts/e2e/run.sh for the CLI/HTTP mock checks.