Only one in-flight candidate

[MCarlomagno]

push_delta rejects any new delta if there’s a pending candidate. Good for safety, but it serializes throughput. We will want a configurable queue depth with strict commitment ordering and per - account sequencing.