Task layer Increment 2b: capacity admission + RemoveNodeFromGroup

[Apollon77]

Sub-PR into node-manager (umbrella PR #3948 carries CI). Increment 2b of the imperative Task layer — capacity admission + removal. Completes Increment 2 (2a = rollback-safety core, merged via #3997).

Spec: docs/superpowers/specs/2026-06-26-node-manager-task-layer-2-design.md (sections C, D, membership key).

What lands

• Per-endpoint membership key — the endpointGroupMembership intent key becomes groupId:endpoint (via a shared membershipKey() helper), and AddNodeToGroup.idFor gains :endpoint, so one peer can join a group on multiple endpoints. GroupMembershipItemKind and groupKeyMap.isReferenced read the intent body (not the key), so the shared-entry refcount cascade is unaffected.
• Pre-flight capacity admission — Task.plannedChanges() declares the intents a task will create; TaskManagerBehavior.#admit runs before any node is touched and rejects the whole task with TaskCapacityExceededError if any (node, kind) would overflow. A rejected task ends failed with an empty changeset (no revert).
• RemoveNodeFromGroup — the inverse task: removes membership, then the group→key-set map, then the key set, each only while no other group still references it (removeIntentIfUnreferenced, dependents-first). Records its own changeset so a cancel restores the group.
• ItemKind.excludeFromAdmission — a kind whose capacity counts a coarser resource than its per-item key (per-endpoint membership vs per-group limit) opts out of admission so it is not double-counted; the group slot is gated by groupKeyMap. capacity still serves the reconciler.
• Merge fix — prettier import-order on harness test files repointed to @matter/node/testing during the main→node-manager merge (fixes the check-and-lint failure on [WIP] Node Manager: desired-state, reconciliation & multi-step tasks #3948).

Tests / gate

• Unit: membership two-endpoint + cross-endpoint revert isolation; admission accept/reject + exclude-from-admission; RemoveNodeFromGroup unshared-teardown + shared-key-set-kept.
• Integration (commissioned peer): round-trip removal, shared key set kept across a group removal, admission rejection end-to-end (device maxGroupsPerFabric: 4, saturated, extra add rejected).
• build --clean ✓ · format-verify ✓ · lint ✓ · node-manager 126/126 · node 1329/1329.

Follow-ups (non-blocking)

• Extract the shared commissioned-peer test helpers (isMember/itemState/awaitState) into one module (currently duplicated across Add/Remove integration files).
• PlannedChange.intent is unused at branch scope (kept for forward use); dedupe the intent literals between plannedChanges() and the provision phase.
• Carried from 2a → Inc3: pass revertOf into the task at creation; narrow a ReconcilerSurface interface to drop test casts.

🤖 Generated with Claude Code

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request