bug: acquire_slot checks capacity and then adds the slot in two calls, so two workers can exceed an agent's cap #3318

Summary

services/slot_service.py::acquire_slot reads ZCARD and then does ZADD as two separate Redis round-trips. Two backend workers can both read count < max_parallel_tasks before either adds its slot, so an agent with cap 1 ends up running 2 tasks. The docs describe this path as an atomic counter (docs/memory/architecture/execution.md, plus a comment in services/capacity_manager.py).

Context

Inside one process nothing can run between the two calls, so only cross-worker admissions are affected. Production compose runs --workers 2. Found by the 2026-10-06 /edge-cases sweep.

Acceptance Criteria

• Admission is atomic: a Lua script or a WATCH/MULTI transaction does the count, cap check and add in one step.
• tests/unit/test_ec_capacity_slots_edges.py::test_r14_concurrent_acquire_across_workers_never_overshoots_cap passes with its marker removed.