docs: add OmniRoute admission lanes finding

[branben]

Summary

Adds an experimental finding documenting OmniRoute's per-session virtual admission lanes as a production implementation of the runtime-layer complement to WG Topic #5 (tool dependencies).

What this demonstrates

• Burst isolation: one session's tool burst doesn't 503 others
• Fair scheduling via FairCostQueue round-robin
• Idle eviction (60s TTL) for bounded memory
• Backpressure with Retry-After headers
• 109 tests passing in production 50k+ star repo

Relevant WG work

• Relates to: Agent Skills Spec Followups #126 (Tool dependencies — Backlog)
• Relevant to: Skills Extension SEP — spec, URI scheme, and reference implementation #75 (Skills Extension SEP — In review)
• Approach: Approach 6 (Official Convention) + runtime capacity gate

Security insight

PR #10110 (pre-auth resource exhaustion) reveals that fake credentials could shard admission lanes before auth. The WG should consider whether malicious declarations in frontmatter could exploit the same pattern.

Verification

git clone https://github.com/diegosouzapw/OmniRoute.git
cd OmniRoute
node --import tsx/esm --test tests/unit/admission-virtual-lanes-9654.test.ts
# Expected: all tests pass

Scope

Tests the dispatch layer, not the manifest layer. Does NOT implement the WG's proposed frontmatter field — implements the runtime gate that makes skill declarations safe under multi-user load.