…, prune firmly at rest

A tunnel server (one relay-grpc-tunnel instance) can only hand a call to a
stream this agent holds on that same server, and the dispatcher sends a
token's calls to one tunnel server at a time. The agent sized its streams as
a total across servers and left placement to the load balancer, which
favours the nearest zone, so the server receiving calls could hold a single
stream: one call in flight made it "all busy" and callers there queued,
with idle streams on other servers and nothing telling the agent to grow.

Streams carry I/O, not work: an open is a round trip on a pooled connection
(the dispatcher is notified only for a token's first stream) and an idle
stream costs its shared tunnel server a heartbeat and a few goroutines. So
the agent now opens greedily and prunes firmly instead of rationing.

Coverage (coverage.go) runs each 1s sizing tick. The agent's streams are
grouped by the tunnel server they landed on (ServerHello.ServerId) into one
serverCoverage each, which reports its state; coverage plans the tick from
those states and balanceCoverage carries the plan out:

  covered    streams >= busy + 2     nothing
  growing    short, calls in flight  open max(8, calls in flight, shortfall)
                                     that tick -- doubling under pressure;
                                     unbudgeted, paused while idle streams
                                     elsewhere reach 4x demand, capped
  filling    short, idle             open toward the reserve, budgeted
  overdue    short, idle, 30s        fill, then evacuate: recycle its idle
                                     streams so it drops the token -- never
                                     a server with calls in flight, only
                                     while another is covered, one per 30s
  evacuated  last 10 minutes         recycle idle streams; no grow or fill

While anything is short the target is held. retireExcess prunes idle
streams once 2 minutes old and unused for 10, never taking a server below
its reserve except to obey a cap. The resting reserve stays at 2 per tunnel
server: a larger one was harder to place under zone-skewed placement and
costs every shared tunnel server more heartbeats.

Each server's budget counts calls in flight, not streams used recently: a
tunnel server hands each call to its newest idle stream, so counting
streams made a quiet server look short and got it evacuated.

Caps: agent maxStreams and MaxInflightRequests 256 -> 2048; tunnel server
MaxStreamsPerToken default 64 -> 1024, since one tunnel server carries a
token's whole concurrency.

Visibility: grpc_tunnel_server_streams{server_id,state},
grpc_tunnel_coverage_actions_total{action=grow|fill|evacuate}, and a
servers array in /systemcheck with each server's streams, busy, budget and
coverage state. Metric construction moves to initMetrics, shared with the
test client.

Tests (coverage_test.go) drive the real sizeTick against simulated workers
and tunnel servers under uniform, zone-skewed and unfillable placement; the
incident cases fail with coverage disabled. Growth is bracketed without
depending on placement: one tick asks for a chunk; with every stream
landing on the busy server a 1000-call burst is in flight in 8 ticks; with
none landing the agent stays bounded and keeps the busy server; after a
burst it prunes back to rest. Older sizing tests are restated in terms of
the reserve and cap constants.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>