Plan-size enforcement is live

Workspace size limits are now enforced in production. Custom runner profiles remain coming soon.

• Published CI size requirements apply to every workspace, new and existing, with no grandfathering or size-admission grace period. Running jobs are preserved.
• A job requesting a locked CI size is refused with plan_required and names the required plan. Runners shows locked sizes with an Upgrade action. Published labels and rates are unchanged.
• Sandbox size limits apply to new creation. Existing sandboxes can still be started or resumed after a downgrade. Entitlement enforcement does not enable the custom-profile service.