fix: harden V2 beta release and bridge capacity

[CasualDeveloper]

Summary

Follow-up to #31 and #32. This restores the release and transport safeguards identified after the V2 work moved to the upstream beta branch.

Changes

• Restore automatic beta CI with the complete npm run verify gate.
• Replace the stable-version release job with a beta-only workflow that validates and publishes the exact reviewed prerelease artifact.
• Make release dry runs write-free and default them to enabled.
• Enforce the configured bridge worker limit instead of spawning untracked overflow workers.
• Release or remove worker capacity before notifying close callbacks, and isolate callback failures from the worker reader.
• Validate bridge pool bounds and keep repeated warmup within maxSize.
• Return retryable HTTP 503 responses when the preserved V1 proxy reaches bridge capacity.
• Restore the documented context-window and output-token environment overrides with positive-integer validation.
• Add shared bridge/configuration regressions to the V2 test gate and update the V1 smoke coverage for bounded capacity.

Verification

• npm run verify
• V1 smoke suite passes, including real proxy saturation and capacity reuse.
• 40 V2/shared tests pass.
• Typecheck and build pass.
• Packed dual V1/V2 package validation passes.
• OpenCode V2 loader smoke passes.

Refs #31.

[CasualDeveloper]

Hi @makeittech, did you have a chance to check this PR out?

It targets beta as discussed in #31, the full verification check is green, and it addresses the release, CI, bridge-capacity, and configuration blockers we identified before publishing the V2 beta - ready for review.

[makeittech]

Thanks a ton for this follow-up, @CasualDeveloper — this closes out the release, CI, and bridge-capacity blockers we flagged in #31, and it's exactly the direction we discussed. I went through the full diff and everything checks out: the fail-fast BridgePoolCapacityError → 503 with Retry-After, the release-before-notify ordering, and the callback-failure isolation are all clean, and the regression coverage (bridge-pool tests plus the real saturation test in the V1 smoke suite) is really solid.

I'm merging this now. 🚀

Just three tiny observations for whenever we next touch this area — none are blocking, so no rush, and feel free to fold them into a later PR or ignore entirely:

• shared-constants.test.ts subprocess runner — under Bun, process.execPath is the Bun binary, so readFallbackLimits actually runs bun -e "import('./src/shared/constants.ts')" and passes because Bun evaluates TS natively, not via the Node type-stripping the code appears to assume. A one-line comment (or pinning to node explicitly) would save future maintainers some head-scratching.
• Release workflow no longer bumps the version — Validate prerelease version only asserts package.json is X.Y.Z-beta.N, so each beta release needs a manual -beta.N+1 bump beforehand. That's the right behavior for "publish the exact reviewed artifact," but a short comment documenting the bump step would help make the intended flow obvious.
• positiveInteger accepts non-decimal forms — Number("1e3") → 1000 and Number("0x10") → 16 both pass. Harmless for these two knobs, just noting Number() is a bit more permissive than "positive integer" implies, in case strict decimal-only input was the intent.

Thanks again for the thorough work and the green verification across the board — much appreciated!