three more off the scale list:
- rate-limit map now gets swept on a cadence (taskrunner.Every) instead of
growing forever — nobody was calling the cleanup. first old ticker moved
onto the runner
- subsystem load was one db query per agent at startup; now it's a single
ANY($1) for all the online ones. 100 agents, 1 query
- outbound http clients (osv, registries, upstream, agent) were inheriting
the stock transport that keeps 2 idle conns per host — so every scan burst
re-dialed. shared tuned transport now, 10 per host, 90s idle
builds clean both modules.
