fix(master): bound large-blob compaction memory

[beinan]

Summary

• serialize master-initiated rollout compactions with a dedicated process-wide semaphore, shared by scheduler and cold-retirement work
• bound each rewrite with configurable input batch size, internal thread count, source-fragment budget, and output-file byte limit
• attempt Lance page-level binary copy before falling back to row decode/re-encode
• execute oversized Lance plans incrementally by truncating public compaction tasks to the configured fragment budget, so a single huge planned group still makes progress
• document and deploy conservative defaults: concurrency 1, threads 1, batch size 8, 32 source fragments, 1 GiB output files

Testing

• ./.codex/skills/ci-pr-helper/scripts/run_ci_checks.sh
• 215 core/workspace Rust tests passed, 3 ignored; integration and service tests passed
• 205 Python tests passed, 2 skipped
• cargo fmt, cargo clippy, ruff format/check, and pyright passed