Use fail-closed, monotonic embedding memory admission

When modifying embedding memory sizing or worker admission, preserve strict safety invariants: reread cgroup membership and mounts for every decision, use the tightest valid headroom across inherited boundaries and runtime limits, and return unknown/deny growth when required data is stale, malformed, ambiguous, or unreadable. Never let clamping increase the original free-memory figure. Account for each worker’s full model/runtime baseline so pool growth cannot multiply pressure or reuse headroom reserved by a starting or retiring worker. Keep one primary worker where required, but gate all additional workers conservatively. Add focused tests for constrained, unlimited, zero, invalid, changing, and low-headroom cases, including exact boundary values and assertions that results never exceed host-free memory.