perf(server): bound the provider runtime-event bus

[ronak-guliani]

Summary

ProviderService exposes a unified provider runtime-event stream via a PubSub that internal consumers (ProviderRuntimeIngestion, CheckpointReactor) each subscribe to through streamEvents. The bus was created with PubSub.unbounded:

const runtimeEventPubSub = yield* PubSub.unbounded<ProviderRuntimeEvent>();

With an unbounded PubSub, each subscriber's backlog can grow without bound if a consumer lags during an event burst (streaming deltas, tool calls, large turns). Under sustained load this risks unbounded memory growth and eventual OOM — a reliability failure mode that is worse than backpressure.

Change

• Switch to PubSub.bounded(RUNTIME_EVENT_BUS_CAPACITY) (capacity 4096).
• Use the suspending (backpressure) strategy rather than sliding/dropping: runtime events feed event-sourced orchestration ingestion and must never be dropped. A lagging consumer now applies backpressure all the way up to the adapter stdio reader instead of silently accumulating memory.
• Added a documented capacity constant explaining the rationale.

This keeps behavior predictable under load (per the project's "reliability first / predictable under load" priorities) while preserving at-least-once delivery semantics.

Why this one

Selected as the highest-impact / lowest-effort item from a performance review (item #2): it removes an unbounded-memory failure mode on the core server event path, is a focused one-constant + one-call change, and carries no event-loss risk.

Verification

• Server typecheck: no real errors (only pre-existing effect-language-service informational diagnostics, none referencing this change).
• ProviderService.test.ts: 28/28 pass.
• ProviderRuntimeIngestion.test.ts + CheckpointReactor.test.ts (the actual bus consumers): 57/57 pass — confirms backpressure does not break event flow.
• oxfmt --check: clean. oxlint: 0 errors (2 pre-existing unrelated warnings).

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com