Choose the pack ceiling before the push instead of retrying after it

The escalation was built as "push at our budget, fail, retry at the target's limit". But whether a checkpoint can be split is knowable before the push — it is just the gap between current and Checkpoints[idx] — so the ceiling can be chosen up front and the retry disappears.

That deletes relaxedRetried, relaxedBudget and both idx++ resets: three pieces of cross-iteration state whose only job was sequencing an attempt and a re-attempt, and where a leaked ceiling bug lived that broke later checkpoints and silently disabled the feature for the second and later branches.

It is also cheaper. A ceiling is an abort threshold, not an upload size, so a pack that fits under the small budget sends exactly the same bytes either way; what changes is that an indivisible commit is no longer uploaded twice — once to abort against a budget that could never have accepted it, and again to ask the target. One fetch, one push, same verdict. For the front-loaded giant-blob shape this exists to serve, the old first attempt could also trip the projection heuristic and fail a pack the target would have taken.

budgetFromObservation survives — provenance cannot be re-derived at the point of use, since "budget below the announced limit" looks identical whether it came from a measured cutoff or from TargetMaxPack being deliberately small — but it moves next to the budget whose provenance it records. It was declared per-branch while that budget spans branches, so a cutoff measured on branch 1 reached branch 2 with its provenance erased and branch 2 escalated past a limit the server had already demonstrated. Same species as the leaked-ceiling bug: provenance has to travel with the value.

Kept deliberately: the >= comparison (an in-batching rejection ratchets budget and announced limit to equality, where escalating still sheds the 5% margin and the projection — without it a pack sized in that last 5% aborts on every delivery forever), and the operator notice, so an unexplained multi-GiB upload never appears without a reason beside it.

Tests move from retry-shaped to ceiling-shaped: the same outcomes, one push instead of two. Mutation-verified that removing the escalation, restoring the 95% margin on the announced ceiling, or treating a deadline as a size verdict each break them.

One gap left honestly: budgetFromObservation still has no coverage. I built a fixture for it, could not make it fail when the guard was removed, and removed it rather than keep a test that passes for reasons I cannot explain. The guard is verified by inspection only.