Use one Dask worker per CPU core

[trashhalo]

Summary

• run one single-threaded Dask worker process per complete available CPU core
• reserve exactly one core when the scheduler shares a worker machine
• exchange detected worker counts to build the encrypted mesh dynamically
• keep GPU assignment exclusive while adding CPU-only workers for remaining cores

Validation

• formatting, Ruff, and ty pass
• documentation build passes
• 235 tests pass; 3 live-Iroh integration tests skip in the shared sandbox
• complete CLI coverage delegated to GitHub Actions because the shared sandbox image does not include git