E2 Phase 1: external-license-resources — xceesd daemon, extres role, EXTERNAL admission

Implements Phase 1 of .kiro/specs/external-license-resources/ (design.md):
externally-reported license pools pushed by a dedicated daemon through the
existing resval pipeline, with EXTERNAL-aware admission arithmetic.

Wire & controller:
- controller.capnp HostRole.extres (@5, appended); xce_join_req accepts it
- extres.c: HostRole_extres join table (endpoint+name, no workermgr slot),
  leave cleanup; join.c/cluster.c dispatch
- opupd.c do_update_resvals: extres branch runs the resource hooks and
  update_resval_list(c, NULL, ...) — host=="" entries route through
  update_val_res' SHARED branch into c->sharedinst; per-entry -EPERM for
  non-shared targets is logged, never fails the list
- worker.c update_val_res: NULL worker only writes SHARED resources
- cluster.c cluster_build_resources: rebuilt on resourceApplyDef (bug-1854)
  — EEXIST-tolerant so definitions added by an activation register on a
  RUNNING controller (bug-1973), and RES_APPLY_CHANGED updates definition
  fields (valtype/ordtype/flags/interval) in place so a corrected config
  heals a stale registration (bug-1974); seed_sharedinst_from_config skips
  EXTERNAL pools (daemon-reported free counts only; seeding would fabricate
  capacity while the daemon is down)

Scheduler:
- core_events.c RESVALS_DELTA: NULL/"" host marks a SHARED value and lands
  in core->sharedInst via dup_val (bug-1585 ownership rule), mirroring
  snapshot_load's host=="" precedent — previously WARN-skipped as unknown
  worker
- resource.c unsatisfy_: EXTERNAL skips the inuse term
  (F >= uncomit + wanted; F is already net of our checkouts)

xceesd (src/esd, new component):
- script collectors polled per source, debounce on unchanged values,
  fail-open stale policy; pushes host=="" shared resvals over xcecli
- reconnect gap fix (bug-1975): with a stable value the debounce pushed
  nothing and reconnects only fire inside a push — after a controller
  restart the daemon sat on a dead connection forever; the main loop now
  forces a full re-push when xcecli_is_connection_broken() (bug-1760
  predicate) latches

Config/mapping:
- resources.yaml: extlic sample (location: [external])
- mapping.py: RESOURCE_FLAG_EXTERNAL (0x10) + location:["external"] mapping;
  xceadmin tests

Tests (TDD, red->green per fix): test_extres_resvals.c (join+resval
pipeline), test_config_resource_reconcile.c +2 (register past EEXIST /
hot-apply changed definition), test_core_events.c +131 lines (shared DELTA
landing), mapping tests. Suites: controller 1358/0, scheduler 100/0,
esd 7/0, lib 1/0; check-no-fork covers src/esd.

Live t1 E2E: config gen=15 push -> xceesd push extlic=4 lands in
sharedinst -> rusage[extlic=3] job RUN; second job PENDs at free=1;
release re-admits it; controller restart -> forced re-push restores the
value and admission resumes. Full precommit job verification passed.

Co-Authored-By: Claude Code <noreply@anthropic.com>

src/scheduler/testsuite/test.c

@@ -730,6 +730,97 @@ test_core_safe_allocation_chain_driver_parity(void)
     destroy(core_sim->resmgr);
 }
 
+/*
+ * external-license-resources Phase 1 (E2), design.md 3.3: the EXTERNAL
+ * accounting rule. An EXTERNAL resource's "total" as pushed by the extres
+ * daemon is already a FREE value F (license server's free count, net of
+ * both external consumers and our own checked-out jobs) -- so re-subtracting
+ * the scheduler's own usage bookkeeping (sharedInUse / w->resInUse) inside
+ * the admission formula would double-count X. The unsatisfy_ loop must
+ * therefore skip the inuse term for resources flagged XCE_RESF_EXTERNAL:
+ *
+ *   EXTERNAL:    total >= uncomit + wanted
+ *   non-EXTERNAL: total >= inuse + uncomit + wanted   (unchanged)
+ *
+ * Shared leg (sched_check_shared_satisfy_): a SHARED|EXTERNAL resource with
+ * total=F=4, sharedInUse=3, uncomit=0 must ADMIT wanted=4 (F >= 0+4) even
+ * though the legacy formula (4 < 3+0+4) would deny it -- and the same shape
+ * WITHOUT the EXTERNAL flag must still deny (legacy semantics pinned).
+ */
+static void test_unsatisfy_external_skips_inuse_shared_leg(void)
+{
+    xce_sched_core_t core;
+    xce_resource_t   wire_resource;
+    xce_resource_t*  made;
+    xce_resource_t*  r     = NULL;
+    xvec_t           uncomitted;
+    xvec_idval_t     wanted, unmeet;
+    xce_val_t        total, inuse;
+    int              rc;
+
+    memset(&core, 0, sizeof(core));
+    /* makeResource() -> resobj_init() -> makeString() needs the intern table
+     * (same per-test init as test_meet_host_selection_string_match). */
+    xstring_table_init(139);
+    init_test_resmgr(&core);
+    zarray_init(&core.sharedInst, 4, NULL);
+    zarray_init(&core.sharedInUse, 4, NULL);
+
+    /* Resource "lic": SHARED (cluster-wide pool) + EXTERNAL (free-value
+     * reporting) -- the shape mapping.py's `location: [external]` produces.
+     * idx 0. */
+    memset(&wire_resource, 0, sizeof(wire_resource));
+    wire_resource.name  = "lic";
+    wire_resource.idx   = 0;
+    wire_resource.flags = XCE_RESF_SHARED | XCE_RESF_EXTERNAL;
+    made                = (xce_resource_t*)makeResource(core.resmgr,
+                                                          &wire_resource);
+    TEST_ASSERT_NOT_NULL(made);
+    TEST_ASSERT_TRUE(key_find(core.resmgr, (void*)"lic", (void**)&r) >= 0);
+    TEST_ASSERT_NOT_NULL(r);
+
+    memset(&total, 0, sizeof(total));
+    total.which    = Value_u_fvalue;
+    total.u.fvalue = 4.0f;
+    memset(&inuse, 0, sizeof(inuse));
+    inuse.which    = Value_u_fvalue;
+    inuse.u.fvalue = 3.0f;
+
+    zarray_put(&core.sharedInst, 0, &total);
+    zarray_put(&core.sharedInUse, 0, &inuse);
+
+    xvec_init(&uncomitted, 1, sizeof(float));
+    xvec_idval_init(&wanted, 1);
+    xvec_idval_store(&wanted, 0, 4.0f);
+    xvec_idval_init(&unmeet, 1);
+
+    /* EXTERNAL: F=4 >= uncomit(0) + wanted(4) -> grant, despite inuse=3. */
+    rc = sched_check_shared_satisfy(&core, &uncomitted, &wanted, &unmeet);
+    TEST_ASSERT_EQUAL_INT(1, rc);
+
+    xvec_idval_fini(&wanted);
+    xvec_idval_fini(&unmeet);
+
+    /* Same shape without EXTERNAL (plain SHARED pool): the legacy formula
+     * must still apply -- 4 < 3+0+4 -> deny. Overwrite the flag in place. */
+    r->flags = XCE_RESF_SHARED;
+
+    xvec_init(&uncomitted, 1, sizeof(float));
+    xvec_idval_init(&wanted, 1);
+    xvec_idval_store(&wanted, 0, 4.0f);
+    xvec_idval_init(&unmeet, 1);
+
+    rc = sched_check_shared_satisfy(&core, &uncomitted, &wanted, &unmeet);
+    TEST_ASSERT_EQUAL_INT(0, rc);
+
+    xvec_idval_fini(&wanted);
+    xvec_idval_fini(&unmeet);
+    xvec_fini(&uncomitted);
+    zarray_fini(&core.sharedInst);
+    zarray_fini(&core.sharedInUse);
+    destroy(core.resmgr);
+}
+
 #define TEST(x)                                                                \
     do {                                                                       \
         if (check_test(&arguments, #x)) {                                      \
@@ -759,6 +850,7 @@ int main(int argc, char* argv[])
     TEST(test_sched_update_existing_queue_null_payload);
     TEST(test_dead_pushmsg_symbols_absent);
     TEST(test_core_safe_allocation_chain_driver_parity);
+    TEST(test_unsatisfy_external_skips_inuse_shared_leg);
 
     return UNITY_END();
 }