Fix project-group route admission evidence

[andrei-hasna]

Summary

• Resolve route throttle limits from task/event metadata when CLI flags are absent.
• Record resolved route scope and throttle context in workflow prompts and invocation manifests.
• Add regression coverage for three sibling rollout tasks sharing a project-group cap of one, plus docs for metadata fields.

Validation

• bun test src/lib/route/drain.test.ts src/lib/route/route-event.test.ts src/lib/templates.test.ts
• bun test src/lib/route/route-event.test.ts src/lib/route/drain.test.ts src/lib/store.test.ts
• bun run typecheck
• bun run test:boundary
• staged secrets scan passed: no credential patterns found in staged diff

Task: 9fac40a9-c03e-4635-9706-c28d249ceb5c