feat(runtime): phase 3 — pluggable run queue (rq-mutex / rq-mpmc / rq-striped)

src/run_queue.rs: the run queue extracted behind a compile-time-selected
type alias; mutually-exclusive cargo features with compile_error! guards
(zero or >1 selected). No runtime dispatch. All variants compile in every
build so their unit tests always run; the feature only picks the alias.

- rq-mutex (default): Mutex<VecDeque>, the control/baseline.
- rq-mpmc: hand-rolled Vyukov bounded MPMC ring, per-cell sequence numbers,
  padded enqueue/dequeue counters. Strict FIFO, lock-free.
- rq-striped: M Vyukov rings (M = thread_count rounded up to pow2),
  fetch-add ticket distribution, probe-from-home on push. Relaxed FIFO with
  stripe-bounded skew; Σcapacity ≈ 2×max_actors so the probe terminates.

Capacity soundness: occupancy ≤ max_actors by the at-most-once-enqueued
invariant + slab cap, rings sized ≥ that bound, so push is infallible; a
full ring panics as a double-enqueue invariant violation rather than spin.

Two contracts the extraction made explicit (documented + debug-asserted):
- Queue ops require preemption disabled: a producer suspended between
  claiming a cell and publishing its sequence stalls every consumer behind
  it — livelock, since the suspended actor's own resume entry is behind the
  hole. Structurally guaranteed since the phase-2 with_runtime NoPreempt fix.
- pop()==None is a snapshot, not a fence. Termination is counter-first:
  every queue entry's target stays Queued (hence live) until that entry is
  popped, so live==0 alone implies nothing actionable is or can be queued;
  argument rewritten at the schedule_loop site. SharedState and with_shared
  are deleted — nothing global is mutex-guarded on the run path under the
  ring variants.

Validated: 22 suites green per variant (release for all three; debug with
live asserts for all three), ring unit tests (FIFO, lap wraparound,
4p/4c exactly-once, skewed drain) in every build, both compile_error!
guards verified to fire.

src/raw_mutex.rs

@@ -27,9 +27,10 @@
 //!
 //! Lock-order position: slot cold locks, the free list, and the stack pool
 //! are all `RawMutex`es and all *leaves among themselves* — never hold two at
-//! once. Holding a `RawMutex` while taking the run-queue mutex (`with_shared`)
-//! is permitted (e.g. unpark from inside a cold section); the reverse —
-//! taking any `RawMutex` from inside `with_shared` — is forbidden.
+//! once. Holding a `RawMutex` while pushing to the run queue is permitted
+//! (e.g. unpark from inside a cold section); the reverse — taking any
+//! `RawMutex` from inside a run-queue op — cannot arise (queue ops call
+//! nothing).
 
 use std::cell::UnsafeCell;
 use std::ops::{Deref, DerefMut};