Add Evergreen active PR leasing

[mrjf]

Summary:

• add an evergreen_active lease label before dispatching an Evergreen agent
• skip already-leased PRs and randomize eligible evergreen PR selection so parallel runs spread across PRs
• allow concurrent no-PR workflow runs while keeping same-PR agent work serialized, and require lease cleanup through safe outputs
• document the controller-owned lease label in TSB policy docs

Validation:

• gh aw compile evergreen --dir .github/workflows --validate --strict --approve --no-check-update --show-all
• gh aw lint --dir .github/workflows