fix(queue): don't count never-executed transient releases against max_attempts

`claim` pre-increments `attempt` before the handler runs, so a real execution
failure legitimately counts toward `max_attempts`. But the two TRANSIENT
release paths — gate saturation (server at capacity) and script-disabled-at-
fire-time — re-queue the message WITHOUT executing it, and previously used the
same `nack` that leaves the pre-increment in place. Under sustained overload a
message could therefore be dead-lettered after N gate-rejections having run
zero times (each rejection burning a retry).

Add a non-counting `release` to both `QueueRepo` and `GroupQueueRepo`
(re-queue + `attempt = GREATEST(attempt - 1, 0)`, mirroring `nack` otherwise)
and route the two transient paths through a new `Dispatcher::q_release`. A real
handler failure still uses `nack` and counts. No schema change.

Pinned by a new `queue_release` DB test (release undoes the claim increment;
nack keeps it) and the updated `disabled_queue_consumer_...` dispatcher test
(now asserts a release, not a nack).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/queue_repo.rs

@@ -112,6 +112,18 @@ pub trait QueueRepo: Send + Sync {
         retry_delay: chrono::Duration,
     ) -> Result<bool, QueueRepoError>;
 
+    /// TRANSIENT release: the handler never ran (gate saturated, or the script
+    /// was disabled at fire time), so re-queue AND undo `claim`'s pre-increment
+    /// of `attempt` — a non-execution must not burn the retry budget (else a
+    /// message could be dead-lettered under sustained overload having executed
+    /// zero times). Floors `attempt` at 0. IFF the claim_token matches.
+    async fn release(
+        &self,
+        message_id: QueueMessageId,
+        claim_token: Uuid,
+        retry_delay: chrono::Duration,
+    ) -> Result<bool, QueueRepoError>;
+
     /// Periodic safety net: clear claims whose `claimed_at` exceeds the
     /// per-queue `visibility_timeout_secs` (joined from
     /// `queue_trigger_details`). Returns the number of rows reclaimed.
@@ -251,6 +263,27 @@ impl QueueRepo for PostgresQueueRepo {
         Ok(res.rows_affected() == 1)
     }
 
+    async fn release(
+        &self,
+        message_id: QueueMessageId,
+        claim_token: Uuid,
+        retry_delay: chrono::Duration,
+    ) -> Result<bool, QueueRepoError> {
+        let next = Utc::now() + retry_delay;
+        let res = sqlx::query(
+            "UPDATE queue_messages \
+             SET claim_token = NULL, claimed_at = NULL, deliver_after = $3, \
+                 attempt = GREATEST(attempt - 1, 0) \
+             WHERE id = $1 AND claim_token = $2",
+        )
+        .bind(message_id.into_inner())
+        .bind(claim_token)
+        .bind(next)
+        .execute(&self.pool)
+        .await?;
+        Ok(res.rows_affected() == 1)
+    }
+
     async fn reclaim_visibility_timeouts(&self) -> Result<u64, QueueRepoError> {
         let res = sqlx::query(
             "UPDATE queue_messages m \