brokersemantics: attribute violations by exact $JS.ACK subject token

The concurrent permission subtests matched their durable as a bare substring of the async error, and denied_nak is a prefix of its sibling denied_nakdelay. Both run against one collector, so the NakWithDelay violation could satisfy the Nak assertion even if plain Nak stopped reporting one — which is exactly what the comment claiming siblings cannot satisfy each other said was impossible.

The rejected subject is $JS.ACK.<stream>.<durable>.<delivered>.<stream seq>.<consumer seq>.<ts>.<pending>, so the durable is always a dot-delimited token; matching "."+durable+"." attributes a violation exactly, and keeps doing so however the fixture's names are chosen later. Renaming the durables would have fixed today's collision only.

Demonstrated both ways, with plain Nak's disposition replaced by a no-op so that only the attribution could fail: with the bounded token the Nak subtest goes red and names the token it could not find while listing denied_nakdelay's violation among what it saw; with the substring match restored, the whole test passes.

doc.go's "Fixtures that cannot fail" now asks for that step explicitly — break the thing the case claims to gate and watch it go red — and records the three fixtures review has caught here doing nothing: the heartbeat test that stopped its own heartbeat, the permission test that covered only Ack, and this attribution. None was a wrong assertion; each was an assertion nothing could break, which is the fake's defect wearing a real broker.