Concurrency was two multiplicative gates in two processes: entrypoint.sh
capped MODELS-at-once per provider (GADFLY_PROVIDER_CONCURRENCY) while each
model's binary separately capped its own lenses (GADFLY_LENS_CONCURRENCY).
A model therefore held its whole model-slot until its LAST lens finished,
stalling the next model even with idle lens capacity.

Collapse to one throttle: a provider-wide lens budget shared across all of
that provider's models. entrypoint now runs every model in a lane at once and
seeds a single cross-process permit pool per lane (a dir of N flock files,
sized by GADFLY_PROVIDER_LENS_CONCURRENCY -> GADFLY_LENS_CONCURRENCY). Each
lens pass (review+recheck) acquires a permit before it runs and releases it
after, so a model winding down immediately yields its freed permits to
another model's queued lenses. flock auto-releases on process death, so a
killed/crashed model can't leak budget.

- cmd/gadfly/lenssem.go: the flock permit pool (+ lenssem_test.go).
- main.go: runSpecialists holds a shared permit per lens; fanout sized to the
  budget so a lone model can use all of it. Falls back to the in-process limit
  when no pool is set (local runs, tests).
- entrypoint.sh: drop provider_cap/DEFAULT_CONC; run_lane runs all models and
  seeds the per-lane pool.
- GADFLY_PROVIDER_CONCURRENCY / GADFLY_CONCURRENCY are now ignored; the
  reusable workflow marks provider_concurrency deprecated and stops forwarding
  it. Docs (README, CLAUDE.md, examples) updated per the maintenance rule.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

@@ -0,0 +36,4 @@
+// when it isn't set (standalone/local runs, tests, or an older entrypoint) — in
+// which case runSpecialists falls back to the in-process fanout limit alone, i.e.
+// the pre-existing per-model behavior.
+func activeLensSem() *lensSem {

@@ -0,0 +51,4 @@
+// acquire blocks until a permit is free (or ctx is done) and returns a release
+// func. On cancellation it returns a no-op release plus ctx.Err(), so callers can
+// surface the lens as "did not run" rather than leaking a permit.
+func (s *lensSem) acquire(ctx context.Context) (func(), error) {

@@ -0,0 +59,4 @@
+		select {
+		case <-ctx.Done():
+			return func() {}, ctx.Err()
+		case <-time.After(lensSemPollInterval):

@@ -0,0 +69,4 @@
+// (entrypoint.sh only guarantees the directory exists), so a fresh pool needs no
+// seeding step beyond mkdir. Closing the *os.File in the returned func drops the
+// flock (the lock lives on the open file description).
+func (s *lensSem) tryAcquire() (func(), bool) {

@@ -261,0 +265,4 @@
+	// The cross-process pool (if any) is the real ceiling; size the in-process
+	// fanout to it so a lone model in its lane can use the whole provider budget,
+	// while extra goroutines simply block in sem.acquire until a permit frees.
+	sem := activeLensSem()