feat(cp): scale hardening — indexed sweeps, sharded admission, borrowed lookup keys #1473

Description

Three scale-dependent ceilings recorded during #1469 round-4 review (F8/F9/F10), all documented v1 tradeoffs rather than defects:

1. Sweeper failure paths are O(expired x in-flight) (router.rs fail_instance/sweep_deadlines): each expired handle rescans the full in-flight table under the global mutex. During mass-expiry events (network partition, CP failover) this blocks complete/cancel on the same lock. Fix: maintain a deadline-ordered index plus a handle -> delegation keys index alongside the primary map.

2. One global admission mutex serializes all namespaces (router.rs delegate): the critical section spans registry scan/sort and serialization of prompts up to 256 KiB. Fix: shard admission by namespace; move serialization/frame construction outside the lock with a rollback path.

3. Per-lookup key allocation (DelegationKey::new): every contains_key/get/parent lookup clones two Strings inside the admission lock. Fix: Borrow-based borrowed-key wrapper for reads.

All three should land with a load regression test.

Use Case

A CP instance serving multiple namespaces with hundreds of concurrent delegations (fleet-wide deployment) must not let one namespace's mass-expiry or large prompts stall every other namespace's admission and completion paths.