perf(planning): prune candidates that cannot beat the protected prefix

Finalizing a candidate never moves or retypes a placement, so preference
results and calendar optimizations already have their final values before
it, and leave-balance optimizations do too when nothing can be earned.
Reject a candidate before finalizing when the first differing such
objective of the protected prefix is worse than the baseline. Leave-placement
objectives and earning contexts stop the walk.

The frozen-engine check now also compares cancelled asynchronous runs,
including checkpoints and retained incumbents. The loaded year drops from
48.5 s to 44.3 s; outcomes, explanations and final states are unchanged.

Refs #284

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/app/services/frozen-engine/leave-planner.core.frozen.d.mts

@@ -1,7 +1,22 @@
-import type { PlanningArtifactsCallback, PlanningOutcome } from '../leave-planner.core';
+import type {
+	PlanningArtifactsCallback,
+	PlanningCheckpoint,
+	PlanningExplanationCallback,
+	PlanningOutcome,
+	PlanningOutcomeCallback,
+} from '../leave-planner.core';
 
 export function calculatePlanningInternal(
 	request: unknown,
 	checkpointCallback?: undefined,
 	artifactsCallback?: PlanningArtifactsCallback,
 ): PlanningOutcome;
+
+export function calculatePlanningAsyncInternal(
+	request: unknown,
+	checkpointCallback?: PlanningCheckpoint,
+	artifactsCallback?: PlanningArtifactsCallback,
+	outcomeCallback?: PlanningOutcomeCallback,
+	explanationCallback?: PlanningExplanationCallback,
+	isCancelled?: () => boolean,
+): Promise<PlanningOutcome>;