[kvlonge]

Why

This combines three fixes so they share one CI run. Each was reviewed and passed checks on its own.

• With a SQLite control store, a write lock held past the 30 s busy timeout stopped the scheduler. It terminated healthy workers and failed the build.
• Workers reported a start for nodes the planner had already skipped. The API rejected the start, the worker stopped, and independent branches ended skipped.
• The fresh-process cache guards failed on runner speed alone. The same-runner cold limits had been sized before native analysis.

Changes

• Busy store: ControlError::transient covers SQLite busy and locked. The scheduler and platform maintenance retry the next cycle, the API answers 503, and workers retry a 503 report with the same event ID. A lost worker after a restart now says so. DuckShop: busy_control_store.json, lost_worker_restart.json.
• Skipped nodes: a worker never reports a start for a node whose outcome it already reported. DuckShop: worker_freshness_skip.yml.
• Perf guards: the cache guard scales its wall budgets by the runner calibration factor. The dense and fresh base/head cold comparisons and the model analysis CPU gate go back to 1.10x. These are test-only changes.

Verification

• Combined branch: the worker and local recovery integration files pass (35 tests). make check-ci passes.
• Each part's own checks passed before combining: orchestration scheduler, API and platform tests on SQLite and PostgreSQL. The new busy-lock and restart tests fail on main and pass here, as does the freshness-skip worker test. The same-machine perf guard check failed an injected 20% slowdown at 1.234x.