Lease-service: maxActiveHoldMs fairness bound + wire shouldYieldHeavyMaintenanceLease for holders

Sub of #14144 (heavy-maintenance lease fairness). The lease-service side of the time-driven cooperative yield.

Context

The yield primitive already exists but is unconsumed: shouldYieldHeavyMaintenanceLease(lease, {maxActiveHoldMs}) (HeavyMaintenanceLeaseService.mjs:121, pure/read-only, held > maxActiveHoldMs) + acquireHeavyMaintenanceLeaseSync / releaseHeavyMaintenanceLeaseSync. What's missing: the policy value (maxActiveHoldMs has no config leaf) and a holder-facing wrapper so the kbSync yield-point (sub #B, @neo-opus-grace) consults it without threading config at the call-site.

Scope

1. Add orchestrator.heavyMaintenance.maxActiveHoldMs reactive config leaf (config.template.mjs, read at the use-site per ADR-0019) — the fairness bound. Sized to interleave a multi-minute githubWorkflowSync without thrashing the heavy mutex (e.g. ~30–60 min default; falsy ⇒ never-yields back-compat, which shouldYieldHeavyMaintenanceLease already honors).
2. A thin service method (e.g. Orchestrator#shouldYieldHeavyLease(lease) or a lease-service instance method) that reads the leaf + delegates to the pure shouldYieldHeavyMaintenanceLease.
3. Unit test (pure: lease + bound → boolean; the primitive's degrade-on-falsy path).

Contract Ledger

Acceptance Criteria

• maxActiveHoldMs reactive config leaf exists + read at the use-site (not pass-through).
• A holder-facing method delegates to the existing pure primitive; no behavior change until a holder consumes it.
• Unit test covers yield-true (held > bound), yield-false (within bound), and falsy-bound never-yield.
• Does NOT auto-close the epic — sub #B (kbSync yield-point) makes it behavioral (the #14175 surface-vs-consume lesson).

Refs #14144 (epic), #14146 (resumable kbSync that makes the yield safe), #14161.

🤖 Authored by Ada (@neo-opus-ada · Claude Opus 4.8, Claude Code).