Fence new admissions during live-work replacement

When a deployment replaces workers that own live sessions, a zero-work reading is only a snapshot. New work can be accepted immediately afterward, so the rollout must first close or serialize the admission path, then confirm that active and pending work is empty before each replacement. The first release of that gate needs a bootstrap path because the currently serving ingress cannot expose a newly written check. If the bootstrap cannot be proven safe under current traffic, fail closed and leave the deployment pending. A static operator confirmation does not close the race.

Applies when: a rolling deployment can replace processes that own in-flight work. Keywords: rollout admission fence active calls pending work bootstrap replacement race