claude-agent-service: wire parallel execution (git-crypt mount, memory, MAX_CONCURRENCY)

The service now runs agent calls concurrently (bounded semaphore, per-job
isolated clones) instead of single-flight. Infra side:
- mount git-crypt-key into the main container (each job re-unlocks its own clone)
- MAX_CONCURRENCY=10 env (excess calls queue FIFO)
- bump pod memory 2Gi req / 12Gi limit, cpu req 1 (Burstable, tier-aux) — sized
  for ~10 concurrent claude+terraform runs; fits node2/3/5 headroom
- docs: beads-auto-dispatch + automated-upgrades no longer describe single-slot

Service code: viktor/claude-agent-service @ 66104a3.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/architecture/automated-upgrades.md

@@ -141,7 +141,7 @@ curl -s -X POST "$WEBHOOK" \
   -d '{"diun_entry_status":"update","diun_entry_image":"<image>","diun_entry_imagetag":"<new_tag>","diun_entry_provider":"kubernetes"}'
 ```
 
-n8n processes all webhooks in parallel (one `claude -p` per webhook). Before bulk runs, increase the rate limit in the n8n Code node (`MAX_UPGRADES_PER_WINDOW`) and reset the counter:
+n8n processes all webhooks in parallel (one `claude -p` per webhook); `claude-agent-service` runs them concurrently via a bounded pool (`MAX_CONCURRENCY`, default 10, excess queued) — it no longer single-flight-locks. Before bulk runs, increase the rate limit in the n8n Code node (`MAX_UPGRADES_PER_WINDOW`) and reset the counter:
 
 ```sql
 -- Reset rate limiter

docs/runbooks/beads-auto-dispatch.md

@@ -137,9 +137,12 @@ bd assign <id> agent     # re-arm for next dispatcher tick
 
 - **Sentinel assignee `agent`** — free-form, no Beads schema change. Any bd
   client can set it (`bd assign <id> agent`).
-- **Sequential dispatch** — matches `claude-agent-service`'s single-slot
-  `asyncio.Lock`. With a 2-min poll cadence and ~5-min average run,
-  throughput is ~12 beads/hour. Parallelism is a separate plan.
+- **One-bead-per-tick dispatch** — the dispatcher submits at most one bead
+  per 2-min tick, gating on `claude-agent-service`'s `/health` `busy` flag.
+  `busy` now means `active >= capacity` (bounded semaphore, default 10) — the
+  service no longer single-flight-locks via `asyncio.Lock`. So up to
+  ~`capacity` beads can run concurrently; the 2-min poll cadence (not
+  single-slot execution) now bounds ramp-up.
 - **Fixed agent (`beads-task-runner`)** — read-only rails, matches BeadBoard's
   manual Dispatch button. Broader-privilege agents stay manual.
 - **CronJob (not in-service polling, not n8n)** — matches existing infra