Bound warm workers' host memory and account local RAM

A worker over FLOW_WORKER_MAX_RSS_MB (--worker-max-rss) when its node
returns is retired instead of kept warm, in the shared pool and in every
declared one; 0, the default, keeps them all. The engine now accounts its
own memory (FLOW_RAM / --ram, else the box or the cgroup limit less 1 GB),
so a node's `ram` declaration holds locally. A declared environment the
shared pool already has is that pool rather than a duplicate set of warm
workers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/fluksio/cli.py

@@ -262,6 +262,8 @@ CONCURRENCY_FLAGS = {
     "max_cascades": "FLOW_MAX_CASCADES",
     "max_runs": "FLOW_MAX_RUNS",
     "gpus": "FLOW_GPUS",
+    "ram": "FLOW_RAM",
+    "worker_max_rss": "FLOW_WORKER_MAX_RSS_MB",
 }
 
 
@@ -751,6 +753,20 @@ def _parser() -> argparse.ArgumentParser:
         metavar="N",
         help="GPUs a node may be given (default: /dev/nvidia* counted, FLOW_GPUS)",
     )
+    serve.add_argument(
+        "--ram",
+        type=_at_least(0),
+        default=None,
+        metavar="MB",
+        help="memory a node may be given (default: worked out, FLOW_RAM)",
+    )
+    serve.add_argument(
+        "--worker-max-rss",
+        type=_at_least(0),
+        default=None,
+        metavar="MB",
+        help="retire a warm worker holding more (default 0: never, FLOW_WORKER_MAX_RSS_MB)",
+    )
     serve.set_defaults(func=cmd_serve)
 
     enroll = subparsers.add_parser("enroll", help="pair this instance with a portal")