add credit leases, reservations, and preflight checks

[bpapillon]

Brings the C# SDK to parity with Node, Go, and Python on credit leases and reservations.

Check with a usage now reserves credits: in client mode against a lease held locally (in memory, or in Redis so a fleet shares one lease), in server mode with one check-and-reserve call. TrackWithReservation settles the reservation and release refunds an unused one. The plain check takes usage, event usage, and credit cost preflight options, threaded to both the API body and the local engine. Identify can prewarm a lease. Extend and check-and-reserve each send a fresh idempotency key per call and keep the default retry policy. Acquire sends none, as in the other SDKs: the API returns the slot's active lease on a repeat.

The Redis key layout and Lua scripts are Node's, byte for byte, so a mixed-language fleet shares leases. conformance/ is copied verbatim from schematic-node and the runner passes every vector on both backends. .NET has no in-process Redis, so the Redis backend runs against a fake that interprets the scripts, which is what the Node reference does too.

C#-specific choices: the check flow reads DataStream through a narrow ICheckDataStream, as Go does, rather than reaching into the client. The generated PreflightRequestBody doubles as the engine's options envelope since the shapes already match. EventBodyTrack.Quantity is a long, so a fractional settle rounds up as in Go. Prewarm takes company keys directly. Server mode maps the API entitlement field by field because the existing converter drops the consumption rate and event subtype.

One behaviour change outside the lease paths: a DataStream that throws on start is now logged and cleared instead of failing the constructor, so the client falls back to REST checks and auto mode resolves to server. This is what schematic-node does, and it is what keeps a bad base URL from taking down a client that REST can still answer for.

[cbrady]

This sends a fractional Usage to the server as-is (Quantity is a double?), but TrackWithReservation settles (long)Math.Ceiling(actual). So Check(usage: 2.5) holds 2.5×rate and later bills 3×rate, which is more than it held.

[cbrady]

here are some claude suggestions:

return DateTime.UtcNow + timeout.Value;
   - This is computed at join time. LeaseCheck passes only requestOptions, not a deadline.
   - Node computes checkDeadline once when the check starts and passes it to maybeExtendInBackground.
   - A check with a 200ms timeout can therefore take acquire time + reserve time + 200ms. That breaks the guarantee the code's own comment describes (a short check shouldn't sit behind a slow extend).
   - Fix: compute the deadline when the check starts and thread it through.
2. A reservation with no lease id is refunded differently from Node. Both reservation stores have:
if (refund > 0 && Field(raw, "leaseId").Length > 0)
   - Node refunds unconditionally. In Node's Redis store an empty lease id disables the lease check, so the refund goes to whichever lease holds the slot now.
   - In a fleet mixing Node and C# servers, the same reservation settles differently depending on which server sweeps or consumes it.
   - The C# behaviour is the safer one, and the comment explains the reasoning. Either port it to Node or call it out in the PR description, since the PR claims byte-for-byte parity.
3. Async work runs while _gate is held. In CreditLeaseManager.cs:
started = AcquireAsync(companyId, creditTypeId, options);
_inflightAcquire[key] = started;
   Also return Track(ExtendIfNeededAsync(...));, both inside lock (_gate).
   - An async method runs synchronously up to its first real await, and that part runs under the lock here.
   - With InMemoryLeaseStore (which returns Task.FromResult), that covers the store reads, the recheck and the HTTP request setup. Every slot's acquires and extends queue behind that.
   - It doesn't deadlock today because Monitor locks are reentrant and the store never calls back into the manager. A user-supplied ILeaseStore or ILeaseWireClient that blocks could stall the whole client.
   - Node has no equivalent problem because it's single-threaded.
   - Fix: register a placeholder under the lock, then start the work after releasing it, e.g. Task.Run(() => AcquireAsync(...)) or a TaskCompletionSource created with RunContinuationsAsynchronously.
4. The new DataStream fallback can leak the replicator health poller. The catch in Schematic.cs calls _datastreamClient?.Close().
   - If the DatastreamClientAdapter constructor throws (e.g. new Uri(baseUrl) on a bad URL), the field was never assigned, so there's nothing to close.
   - The constructor has already started _replicatorHealthService (its own HttpClient plus .Start()), so in replicator mode that poller keeps running with nothing left to dispose it.
   - Separately, the fallback turns a bad base URL from a constructor exception into one logged error. REST then uses the same bad URL, and CheckFlag quietly returns defaults.
   - Node behaves the same, but this is a visible behaviour change for existing C# users and deserves a changelog line.
5. A joiner can wait on an extend that decides not to extend. RecheckAndExtendAsync rechecks against the requirement of whichever caller started the extend, not the joiner's.
   - If a sibling extend lands first, that recheck can decide no extend is needed. The joiner then accepts the entry with too little left, and its retry reserve fails.
   - Node has the same logic, so this is an upstream issue rather than a port bug. It's cheap to fix here: have the joiner re-run NeedsExtend against its own requirement.
6. Minor robustness points:
   - InMemoryLeaseStore compares DateTimes without normalizing Kind, so a non-Z expiry from the API would shift expiry by the host's UTC offset. The Redis path is unaffected.
   - DrainAsync can briefly busy-loop without yielding when a task has completed but its cleanup continuation hasn't run yet.
   - ReleaseAllLocalLeasesAsync calls lister.ListAsync() with no local try/catch, although the outer catch in Shutdown covers it.
7. Out of scope: WithHttpClient doesn't copy AdditionalHeaders. That bug already exists on main; it's worth a separate fix.```