fix(execution): keep the over-limit abort path release-free

The abort guard fires for any non-acquired result, so an over-limit acquisition
that was already aborted also released — contradicting the rule stated two lines
below, where the same result returns without releasing because the script
answers before its ZADD. Restrict the release to undetermined results and assert
the no-release behavior in the existing over-limit abort test.

Author: waleedlatif1

apps/sim/lib/execution/isolated-vm.test.ts

@@ -704,6 +704,7 @@ describe('isolated-vm scheduler', () => {
   })
 
   it('reports cancellation when abort races a rejected distributed lease', async () => {
+    const scripts: string[] = []
     let resolveLease!: (value: number) => void
     let markLeaseRequested!: () => void
     const leaseResult = new Promise<number>((resolve) => {
@@ -719,6 +720,7 @@ describe('isolated-vm scheduler', () => {
       spawns: [() => createReadyProc('unused')],
       redisEvalImpl: (...args: unknown[]) => {
         const script = String(args[0] ?? '')
+        scripts.push(script)
         if (script.includes('ZREMRANGEBYSCORE')) {
           markLeaseRequested()
           return leaseResult
@@ -748,6 +750,8 @@ describe('isolated-vm scheduler', () => {
       termination: 'cancelled',
       error: { name: 'AbortError' },
     })
+    // Redis answered before its ZADD, so there is nothing to remove.
+    expect(scripts.some((script) => script.includes("'ZREM'"))).toBe(false)
     expect(spawnMock).not.toHaveBeenCalled()
   })
 

apps/sim/lib/execution/isolated-vm.ts

@@ -1436,7 +1436,8 @@ export async function executeInIsolatedVM(
   }
 
   if (leaseAcquireResult !== 'acquired' && signal?.aborted) {
-    releaseLease()
+    // Only an undetermined result can have registered; see the over-limit branch below.
+    if (leaseAcquireResult === 'undetermined') releaseLease()
     maybeCleanupOwner(ownerKey)
     return {
       result: null,