Function check_before_spawn 

pub async fn check_before_spawn(
    store: Option<Arc<LeaseStore>>,
    uid: &str,
    agent: &str,
    own_boot_id: &str,
) -> Result<(), String>

The early, read-only admission check (see module doc). Err is the user-facing refusal; callers must run it before any shared write.