CB-583: make bridge_list's capacity view quarantine-aware

A quarantined profile's capacity row now forces free:0 and names the
quarantine (credentialId, quarantinedForSeconds), reusing the same
QuarantineSource bridge_profiles already reads instead of a second
lookup. An ordinary fleet's capacity rows are unchanged (no new keys).

bridged/src/main/java/dev/ltms/bridged/mcp/BridgeMcp.java

@@ -231,7 +231,7 @@ public final class BridgeMcp {
                 .toolCall(listTool(), (exchange, _) -> {
                     McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                     if (denied != null) return denied;
-                    return listFleet(workers, sessions, messages, capacity, healthCoverage,
+                    return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine,
                             callers == null ? Map.of() : callers.leads(),
                             callerTerminal(exchange));
                 })
@@ -767,17 +767,22 @@ public final class BridgeMcp {
      * caller's own row is flagged {@code "self": true}: a peer needs to tell its own pane apart from
      * a peer's, and the alternative is every lead calling {@code bridge_whoami} to subtract itself.
      *
+     * <p>CB-583: the {@code capacity} rows reuse {@code quarantine} (the same {@link QuarantineSource}
+     * {@code bridge_profiles} reads) so the two surfaces cannot disagree about which profile is
+     * quarantined — see {@link #capacityView}.
+     *
      * @param leads    terminal_id → lead name, live from the resolver
      * @param selfTerm the calling pane's terminal id, or blank for a caller with no pane
      */
     static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions,
                                               Map<String, String> leads, String selfTerm) {
-        return listFleet(workers, sessions, null, CapacitySource.none(), new HealthCoverageSource(() -> "off"), leads, selfTerm);
+        return listFleet(workers, sessions, null, CapacitySource.none(), new HealthCoverageSource(() -> "off"),
+                QuarantineSource.none(), leads, selfTerm);
     }
 
     static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions, MessageService messages,
                                                CapacitySource capacity, HealthCoverageSource healthCoverage,
-                                              Map<String, String> leads, String selfTerm) {
+                                               QuarantineSource quarantine, Map<String, String> leads, String selfTerm) {
         try {
             Map<String, Agent> live = workers.list().stream()
                     .map(Agent.class::cast)
@@ -798,7 +803,7 @@ public final class BridgeMcp {
             result.put("healthCoverage", healthCoverage.value().get());
             if (capacity.available()) result.put("capacity", profiles.stream()
                     .map(profile -> capacityView(profile, capacity.liveCount(), capacity.maxLoad(), roster, messages,
-                            capacity.clock().getAsLong())).toList());
+                            capacity.clock().getAsLong(), quarantine)).toList());
             return text(json(result));
         } catch (HerdrException e) {
             return error("herdr error listing the fleet: " + e.getMessage());
@@ -823,9 +828,18 @@ public final class BridgeMcp {
         return row;
     }
 
+    /**
+     * CB-583: {@code free} alone cannot tell a lead "busy, will free up" from "refusing, and
+     * nothing changes for N seconds" — those need different decisions. So a quarantined profile
+     * forces {@code free} to 0, whatever its {@code maxLoad}/{@code live} say, and the row carries
+     * the same {@code credentialId}/{@code quarantinedForSeconds} facts {@code bridge_profiles}
+     * reports, reusing {@link QuarantineSource} rather than a second lookup. Both new keys are
+     * added only when the profile is actually quarantined, so an ordinary fleet's rows are
+     * byte-identical to before this change.
+     */
     private static Map<String, Object> capacityView(String profile, Function<String, Integer> liveCount,
                                                      Function<String, Integer> maxLoad, List<MemberSession> roster,
-                                                     MessageService messages, long nowNanos) {
+                                                     MessageService messages, long nowNanos, QuarantineSource quarantine) {
         Integer cap = maxLoad.apply(profile);
         int live = liveCount.apply(profile);
         int reclaimable = (int) roster.stream().filter(s -> profile.equals(s.profile()))
@@ -835,6 +849,14 @@ public final class BridgeMcp {
         Map<String, Object> row = new LinkedHashMap<>();
         row.put("profile", profile); row.put("maxLoad", cap); row.put("live", live);
         row.put("free", cap == null ? null : Math.max(0, cap - live)); row.put("reclaimable", reclaimable);
+        String credentialId = quarantine.credentialIdFor().apply(profile);
+        if (credentialId != null) {
+            quarantine.quarantine().remainingSeconds(credentialId).ifPresent(remaining -> {
+                row.put("free", 0);
+                row.put("credentialId", credentialId);
+                row.put("quarantinedForSeconds", remaining);
+            });
+        }
         return row;
     }
 
@@ -994,7 +1016,12 @@ public final class BridgeMcp {
                         + "sessions delegated to — each with sessionId, paneId, role (architect/dev/"
                         + "reviewer), profile (the backend it runs on), state, optional "
                         + "worktree/branch/owner, and live herdr status. An empty 'members' "
-                        + "means no members are spawned; it says nothing about peers.",
+                        + "means no members are spawned; it says nothing about peers. When capacity "
+                        + "facts are configured, a 'capacity' row per profile also reports free: 0 for "
+                        + "a quarantined profile's credential (see bridge_profiles), whatever its "
+                        + "maxLoad/live — with credentialId and quarantinedForSeconds naming the "
+                        + "quarantine, so 'free: 0, busy' can be told apart from 'free: 0, refusing "
+                        + "for N seconds'.",
                 objectSchema(Map.of(), List.of()));
     }