fix(opf): run one flush worker per repository

The 5-minute spawn throttle was the only guard between workers, but a worker can run for hours. A later push could start a second worker that repeated the same model calls on the same refs and then lost the ref CAS. The worker now holds a lock in the git common dir for its whole run, and one that cannot take it exits; the running worker re-reads the backlog after each pass.

Also document chunked OPF calls and the single-worker rule.