Set Selection Gate

Turn the selector on or off for this workspace, in seconds rather than in a deploy.

This exists because arbitration CANCELS real scheduled runs and a cancelled run keeps its dedup slot, so the people silenced during a bad window are not recovered by the next poll. A kill switch whose latency is a task-definition revision plus a service update is not a kill switch. Failures are surfaced rather than swallowed: an operator reaching for this has to find out immediately if it did not take.