Retrofit fetch-thread-pool + compute-process-pool into _run_stage_c (issue #566)

[WilfordGrimley]

Summary

Retrofit fetch-thread-pool + compute-process-pool into _run_stage_c (issue #566), plus the fixes CI and review surfaced on top of the original design:

1. Replace the single fetch-ahead thread + sequential compute loop with:
   • ThreadPoolExecutor(3) for fetch (I/O-bound, benefits from concurrency)
   • ProcessPoolExecutor(3) for compute (CPU-bound, previously sequential)
   • Bounded backpressure drain at _STAGE_C_POOL_QUEUE_DEPTH=6 (2x workers) to keep RSS flat
2. Lockout-drain fix: fetch-future consumption switched from as_completed() (completion-order, racy) to a submission-order list blocked via .result(). Under as_completed(), a lockout on card B could outrace and silently discard an already-successful card A before its compute was ever submitted, violating the "in-flight work drains, nothing new starts" invariant from issue Retrofit decoupled fetch/compute into streaming Stage C (ratified §4 item 3, unimplemented in Phase 2) #472. The fetch threads still run concurrently — only result CONSUMPTION order is fixed, so there is no throughput loss.
3. Test twin deleted: an earlier revision of this branch gated a second, inline copy of the coordinator loop behind PYTEST_CURRENT_TEST, which meant every test took the inline path and the pooled loop that ships was executed by none of them. _run_stage_c_phase2_inline, _inline_compute_active and _INLINE_COMPUTE_FOR_TESTS are now deleted (105 lines removed, no replacement), so stage_e_dispatch.py contains no test-mode detection at all. Tests instead substitute _SyncStagePoolStub for the module-level ThreadPoolExecutor and ProcessPoolExecutor names, which runs the single production loop under a synchronous pool. That is the technique test_run_image_evidence_cohort.py already uses via its own _SyncPoolStub.
4. Removed the parent-side connection.close() before forking the compute pool — it was breaking this coordinator's own later DB writes (mark_ledger_failed on a compute-side crash). Each compute worker closes its own inherited connection copy in _stage_c_compute_worker_init, which is the side that actually needs a fresh connection post-fork.
5. image-cdn/wrangler.toml: IMAGE_FULL_TIER_RATE_LIMITER 150 to 60 (15/s to 6/s), the owner-approved value, staying under the 7/s client-side GOOGLE_IMAGE ceiling so the worker limiter remains the binding politeness control.

Test coverage, stated honestly: the coordinator loop that ships is now the one tests execute — lockout drain, error propagation, throttle handling, backpressure accounting and both pool shutdowns all run through the production code path. What the stub does not exercise is real process semantics: fork, worker crash recovery, and pool teardown under a genuine ProcessPoolExecutor. _stage_c_compute_worker_init has direct unit coverage of its own. That residual gap is the same one run_image_evidence_cohort.py carries and is closed only by a production run.

Closes #566.

Test plan

• Regression test test_lockout_mid_prefetch_drains_the_already_fetched_card_but_starts_no_more — card A gets ImageEvidence persisted, cards B and C do not, status is completed-with-trip. Confirmed to FAIL against the pre-fix as_completed() consumption order across 8 PYTHONHASHSEED values and to pass with the fix, so it grades production code rather than a twin.
• Direct unit coverage added for _stage_c_compute_worker_init (short-circuit on, default, short-circuit off).
• Full backend suite: cd MPCAutofill && pytest . — the same invocation .github/actions/test-backend uses — run in a local venv (Django 4.2.30, pytest 9.1.1). 3571 passed, 8 skipped, 0 failed in 478.33s.
• Concurrency caps unchanged: fetch 3 threads, compute 3 processes, queue depth 6. No cap was raised to make anything pass.
• Lint and type checks via pre-commit on commit: ruff, isort, black, mypy, prettier all clean.
• manage.py makemigrations --check --dry-run --skip-checks — no changes detected.
• wiki: no change — an internal coordinator-loop fix plus a rate-limiter value, with no user- or admin-visible surface.
• docs/upstreaming/extractable-primitives.md: no change — _run_stage_c is fork-entangled catalog pipeline code, not a new or destroyed no-dependency primitive.
• CI on this push (bf4bf90): all 14 required checks green, including "Backend tests" (7m36s) and "Formatting and static type checking". mergeable_state=clean.