build: reconcile #344 with the remaining Reservoir dependency

[thomhurst]

Problem

#344 ("internalise the Reservoir object pool — zero-dependency core, unblocks strong naming") is closed as completed, but the dependency is still present:

• src/Kevlar/Kevlar.csproj:19 has <PackageReference Include="Reservoir" />.
• Directory.Packages.props pins Reservoir to [1.9.1,2.0.0), and chore(deps): upgrade Reservoir to 1.9.1 #497 upgraded it.
• using Reservoir appears in KevlarContext.cs, KevlarProperties.cs, Strategies/Hedging/HedgingStrategy.cs, and Strategies/Timeout/TimeoutStrategy.cs.
• scripts/Verify-Packages.ps1:307-309 asserts Reservoir as an expected dependency for every target.

#344 has no closing comment, so the decision is not recorded.

Proposed fix

Decide and record one of:

• Keep the dependency. Comment on build(deps): internalise the Reservoir object pool — zero-dependency core, unblocks strong naming #344 with the reason and make sure no documentation still claims a dependency-free core.
• Vendor the pool. Add an internal ObjectPool under src/Kevlar/Internal/, drop the package reference, and update Verify-Packages.ps1, PackageDependencyPolicy.ps1, and renovate.json.

Tests

• Verify-Packages.ps1 passes for the chosen outcome.
• Allocation gates and benchmarks unchanged.