Fence new Turns and request a restart only when existing work is idle.

Return restart_required=True on acceptance. Return 409 when setup is not ready or a Turn or workspace operation is active, leaving that work running. Concurrent attempts are serialized so a rejected request cannot reopen setup after an accepted restart.