fix(controller): reject submissions to closed or unknown queues (bug-1960)

Cause: handle_jobsubmit() never looked at the target queue, so a
submission that bypassed the apiserver's check (libxce, harness
xce_test, or a REST submit without a queue name) was accepted into a
closed queue, an unknown queue, or the reserved lost_and_found queue.

Fix: jobsubmit_check_queue() reads the queue's in-memory state under the
qmgr/queue read locks. handle_jobsubmit() calls it after the field
checks and before the in-flight jobid registry and any WAL append, for
single jobs and job arrays. It replies -E_XCE_QUEUE_CLOSED (new code,
"queue is closed") for a closed queue and -E_XCE_BAD_QUEUE for an
unknown or reserved one. Apply/replay (restore_job) is unchanged, so
committed submit facts for a now-closed queue still apply.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/include/xce/errnox.h

@@ -25,6 +25,7 @@ enum {
     E_XCE_STANDBY,    /* Controller in CTRL_STANDBY; op is primary-only     */
     E_XCE_ARRAY_START0, /* Array submission numbered from 0; numbering starts
                          * at 1, the submitting client must be upgraded    */
+    E_XCE_QUEUE_CLOSED, /* Submission to a closed queue (bug-1960)          */
     E_XCE_MAX
 };