Add a read-only headroom preflight before State Hub promotion.

STATE-WP-0091: refuse Helm when remaining CPU cannot cover the API
surge, migrate hook, or unrelated pending demand. 65m fails, 105m is
narrowly sufficient, not factory admission.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

tests/fixtures/release_headroom/rev61-65m.json

@@ -0,0 +1,16 @@
+{
+  "observed_at": "2026-09-10T12:00:00+00:00",
+  "freshness_seconds": 0,
+  "nodes": [
+    {
+      "name": "railiance01",
+      "ready": true,
+      "unschedulable": false,
+      "allocatable_cpu_m": 4000,
+      "allocatable_memory_bytes": 16000000000,
+      "allocated_cpu_m": 3935,
+      "allocated_memory_bytes": 8000000000
+    }
+  ],
+  "pending_unrelated": []
+}

tests/fixtures/release_headroom/rev63-105m-concurrent-pending.json

@@ -0,0 +1,22 @@
+{
+  "observed_at": "2026-09-10T13:05:00+00:00",
+  "freshness_seconds": 0,
+  "nodes": [
+    {
+      "name": "railiance01",
+      "ready": true,
+      "unschedulable": false,
+      "allocatable_cpu_m": 4000,
+      "allocatable_memory_bytes": 16000000000,
+      "allocated_cpu_m": 3895,
+      "allocated_memory_bytes": 8000000000
+    }
+  ],
+  "pending_unrelated": [
+    {
+      "name": "other/unrelated-worker",
+      "cpu_m": 50,
+      "memory_bytes": 0
+    }
+  ]
+}

tests/fixtures/release_headroom/rev63-105m.json

@@ -0,0 +1,16 @@
+{
+  "observed_at": "2026-09-10T13:00:00+00:00",
+  "freshness_seconds": 0,
+  "nodes": [
+    {
+      "name": "railiance01",
+      "ready": true,
+      "unschedulable": false,
+      "allocatable_cpu_m": 4000,
+      "allocatable_memory_bytes": 16000000000,
+      "allocated_cpu_m": 3895,
+      "allocated_memory_bytes": 8000000000
+    }
+  ],
+  "pending_unrelated": []
+}