Address review: pin the gate, the >= boundary, and the measured-cutoff guard

The rewrite had no correctness bug, but mutation testing found it had deleted the only coverage of its own central claim. Three mutants survived the whole suite; all three now fail.

The gate itself was untested: dropping isIndivisibleCheckpoint from the ceiling decision left every test green, so nothing pinned that ONLY an unsplittable checkpoint escalates. That mutant pushes every checkpoint at the announced ceiling with no margin and no projection, silently destroying the bound on wasted upload that is the entire reason TargetMaxPack is small. The deleted budget-leak test had been the closest thing to coverage. Replaced with a divisible span that must still abort at the small budget.

The >= boundary was untested too. An in-batching rejection ratchets the budget down to the announced limit, leaving them equal, and escalating there still sheds the 95% margin and the projection — a pack sized inside that last 5% would otherwise abort on every delivery forever. Now pinned by a pack at 97.8% of an announced limit the run learns from its own one-shot rejection.

And the measured-cutoff guard is covered at last. The reviewer worked out why my earlier fixture could not bite: on a one-commit chain the guard is structurally unreachable, because any failure that would set it ends the run on that same checkpoint and no later iteration remains to read it — and a pusher that never drains leaves sentBytes at 0, so it is never set at all. Reaching it needs two commits: a divisible span to take the observation, then an indivisible one to consult it. Their fixture, with that reasoning recorded in the test so the next person does not repeat the dead end.

Note for anyone mutation-testing this file: removing the guard from the condition makes the variable unused, so that mutant does not compile and a grep for test failures reports a false negative. Keep it referenced.

Also fixes three comments left describing the retry this design removed — including a dangling paragraph about the deleted relaxedBudget fused onto the new comment — and emits the announced-ceiling notice once per branch rather than per push, since the ceiling is now chosen per push and an uneven-gap stretch would otherwise repeat it for packs nowhere near either number. The structured log still records every push.