Address review: valid pack headers in fixtures, and report the ceiling in force

The bottom-out fixtures used "PACK" plus filler, whose version field is 0x78787878 — so checkPackSizeAndSubdivide read an object count of 2,021,161,080 off it, and the observer left TotalObjects at 0 because the scanner rejected the header. The tests passed, but partly through a path nobody intended, and the zero silently closed the projection that sizes the next subdivision.

They now build a real header. The helper that does it already existed as a closure inside TestCheckPackSizeAndSubdivide; it is hoisted to package scope with a note on why fixtures must use it, since the failure mode is invisible — a bogus header does not fail a test, it just quietly disables a branch.

Both mutation checks still fail as they should with the corrected fixture, so the blocker regressions are unaffected.

Also: the "limit_bytes" log field took its value from selfImposedBudget rather than the budget actually in force, under-reporting the ceiling on a relaxed retry — the one path this change added for diagnosability. No functional effect; the checkpoint is indivisible by then, so nothing could expand regardless.