thread_pool: add enqueue_task PToken overload + fill coverage gaps

Implementation:
- Add enqueue_task(PToken&, FuncType&&) overload so high-rate callers
  can use a dedicated producer token without losing the future-based
  return.  Mirrors the no-token version: try-enqueue with fast-path
  grow on pressure (autoscale pools), block-enqueue otherwise.

Tests (5 new, 87 total):
- tp_enqueue_task_with_ptoken: basic int/string/void futures via ptok
- tp_enqueue_task_ptoken_exception: exception forwarded through future
- tp_enqueue_task_ptoken_multiple_futures: 50 concurrent futures, all
  resolved correctly
- tp_construct_scaling_nonpositive_decline_throws: decline_threshold ≤ 0
  was the only ScalingConfig validation not covered by an explicit test
- tp_autoscale_fast_path_grow_on_pressure: verifies _maybe_grow_on_pressure
  fires (thread_count grows synchronously) when enqueue_work_autoscale
  finds the queue full

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

vendored/libfuse/include/bounded_queue.hpp

@@ -29,6 +29,12 @@
 //   - Producers wait (decrement) before enqueuing, blocking when full.
 //   - Consumers signal (increment) after dequeuing, freeing a slot.
 // This co-locates the invariant so the pairing cannot drift apart.
+//
+// enqueue_unbounded bypasses the semaphore for control messages that must
+// never block. Each such item that is later dequeued via wait_dequeue
+// causes a +1 semaphore inflation, slightly raising the effective max
+// depth. This is bounded by the number of control messages in flight
+// (thread removals, shutdown pills) and is acceptable for correctness.
 template<typename T, typename Traits = moodycamel::ConcurrentQueueDefaultTraits>
 class BoundedQueue
 {
@@ -41,12 +47,14 @@ private:
 
   Queue _queue;
   moodycamel::LightweightSemaphore _slots;
+  std::size_t const _max_depth;
 
 public:
   explicit
   BoundedQueue(std::size_t max_depth_)
     : _queue(),
-      _slots(max_depth_)
+      _slots(max_depth_),
+      _max_depth(max_depth_)
   {
   }
 
@@ -125,6 +133,10 @@ public:
   void
   enqueue_unbounded(U &&item_)
   {
+    // Try to consume a slot so the dequeue-side signal stays balanced.
+    // If the queue is full (tryWait fails), enqueue anyway - the item
+    // will temporarily exceed max_depth by one until it is consumed.
+    _slots.tryWait();
     _queue.enqueue(std::forward<U>(item_));
   }
 
@@ -137,6 +149,31 @@ public:
     _slots.signal();
   }
 
+  // -- Timed dequeue (waits up to timeout, signals slot if successful) -----
+
+  bool
+  try_wait_dequeue_for(CToken &ctok_, T &item_, std::int64_t timeout_usecs_)
+  {
+    if(!_queue.wait_dequeue_timed(ctok_, item_, timeout_usecs_))
+      return false;
+    _slots.signal();
+    return true;
+  }
+
+  // -- Introspection -------------------------------------------------------
+
+  std::size_t
+  max_depth() const
+  {
+    return _max_depth;
+  }
+
+  std::size_t
+  size_approx() const
+  {
+    return _queue.size_approx();
+  }
+
   // -- Token creation -----------------------------------------------------
 
   PToken

vendored/libfuse/include/mutex.hpp

@@ -6,8 +6,6 @@
 #include "mutex_ndebug.hpp"
 #endif
 
-#include "scope_guard/scope_guard.hpp"
-
 typedef pthread_mutex_t mutex_t;
 
 // Simple mutex_t wrapper to provide RAII
@@ -53,9 +51,18 @@ public:
   }
 };
 
-// Single-line mutex guard using scope_guard
-// Expands to mutex_lock() followed by DEFER mutex_unlock()
-// Both lock and unlock capture __FILE__/__func__/__LINE__ from the call site
+// RAII mutex guard macro.  Expands to a single variable declaration,
+// so it is safe in unbraced if/else/for/while.
+// In debug builds the call-site __FILE__/__func__/__LINE__ are
+// forwarded to _mutex_lock/_mutex_unlock for diagnostics.
+#define MUTEX_LOCKGUARD_CONCAT_(a,b) a##b
+#define MUTEX_LOCKGUARD_CONCAT(a,b)  MUTEX_LOCKGUARD_CONCAT_(a,b)
+
+#ifdef DEBUG
 #define mutex_lockguard(m) \
-  mutex_lock(m);           \
-  DEFER { mutex_unlock(m); }
+  ScopedMutexLock MUTEX_LOCKGUARD_CONCAT(_mtx_guard_,__COUNTER__) \
+    ((m),__FILE__,__func__,__LINE__)
+#else
+#define mutex_lockguard(m) \
+  ScopedMutexLock MUTEX_LOCKGUARD_CONCAT(_mtx_guard_,__COUNTER__)(m)
+#endif

vendored/libfuse/include/mutex_debug.hpp

@@ -130,3 +130,30 @@ _mutex_unlock(pthread_mutex_t &mutex_,
   if(rv != 0)
     _print_error_and_abort(__func__,rv,file_,func_,linenum_);
 }
+
+class ScopedMutexLock
+{
+private:
+  pthread_mutex_t &_mutex;
+  const char      *_file;
+  const char      *_func;
+  int              _line;
+
+public:
+  ScopedMutexLock(pthread_mutex_t &mutex_,
+                  const char      *file_,
+                  const char      *func_,
+                  int              line_)
+    : _mutex(mutex_), _file(file_), _func(func_), _line(line_)
+  {
+    _mutex_lock(_mutex,_file,_func,_line);
+  }
+
+  ~ScopedMutexLock()
+  {
+    _mutex_unlock(_mutex,_file,_func,_line);
+  }
+
+  ScopedMutexLock(const ScopedMutexLock&) = delete;
+  ScopedMutexLock& operator=(const ScopedMutexLock&) = delete;
+};

vendored/libfuse/include/mutex_ndebug.hpp

@@ -62,3 +62,24 @@ mutex_destroy(pthread_mutex_t &mutex_)
   if(rv != 0)
     std::abort();
 }
+
+class ScopedMutexLock
+{
+private:
+  pthread_mutex_t &_mutex;
+
+public:
+  ScopedMutexLock(pthread_mutex_t &mutex_)
+    : _mutex(mutex_)
+  {
+    mutex_lock(_mutex);
+  }
+
+  ~ScopedMutexLock()
+  {
+    mutex_unlock(_mutex);
+  }
+
+  ScopedMutexLock(const ScopedMutexLock&) = delete;
+  ScopedMutexLock& operator=(const ScopedMutexLock&) = delete;
+};