Dispatch ledger and node concurrency: deferred hardening

Follow-ups deferred from Task 7159 (parallel lease execution + pass-wide account ledger, PR #5889). 1. `apps/api/app/routes/fleet.py` build_dispatch_plan: an account place booked for a decision the drain later declines (no slot, memory/disk wait, contained raise) stays booked for the rest of the pass and holds other nodes back. Give it back on those paths (incl. a try/except around the post-book section). 2. Same file: the pass ledger lock is held across `_account_for_task`'s DB reads, serializing account picks across nodes. Pick outside the lock, then re-check the cap and book under it (retry on conflict). 3. `apps/jaahd` concurrent claims of different projects queue on `clone_identity`'s single network-git lock (60s wait); a first clone of a large repo turns sibling claims into `refused_precondition`. Run chains that need a first clone last/serially, or don't charge those refusals to the park budget. 4. `apps/jaahd/git_env.NO_REPO_CODE` does not neutralise repo-local `filter.*` / `diff.external` drivers; a filter planted in a project's tree can still see that SAME project's token during its own fetch inside `cloning`. Avoid running checkout/smudge inside `cloning`, or pin filters off for daemon git. 5. Tests that would catch removal of `fleet_launch._SPAWN_LOCK` and of the `_account_lock` call sites in `fleet_dispatch.launch_runner` (peak-concurrency tests with stubbed tmux / converge). Out of scope: changing any cap's value. Done means: - Each item fixed with a test, or rejected with a reason; `./dc check quick` green.

All 5 items fixed with tests in PR #5921 (merged f2425780): ledger gives back undispatched places, pick outside lock (CAS + retry), clone-busy not charged to park budget, sync_develop fetch-only declaration, lock tests. Quick gate + changed suites green; deploy superseded. Follow-ups #7261, #7284 (drafts).