backoff, jsconsumer: qualify three doc claims the suite falsified

Review of the COR-1257 suite found three public contracts still promising what the broker was just measured not to do. Comments and one error string only; no behaviour changes.

backoff.Outcome / NakOrTerm implied that a disposition either happened or returned an error. Ack, Nak and Term are fire-and-forget publishes to $JS.ACK.>, so a nil error means the request reached the connection and nothing more: without publish permission on $JS.ACK.> (COR-1224) every disposition returns nil while the server rejects it, the delivery stays outstanding, and the ack floor stops advancing silently. Outcome is now documented as the disposition ATTEMPTED, the grant and the async-error handler are named as requirements, and DoubleAck's error is documented as meaning "unknown" — a lost confirmation is indistinguishable from an ack that landed, so it is not grounds to re-dispatch the work.

backoff.Policy and DelayFor read as unconditional, but the delay they compute is only what the broker serves when the consumer's on-server BackOff ladder is absent or flat. A growing ladder stretches every requested delay by (BackOff[rung] - BackOff[0]) — by hours on a production ladder — so an independent backoff user can deploy an envelope materially longer than the one it logs and meters. Both now carry the formula and the consequence: on such a ladder the faithful disposition is doing nothing and letting AckWait expire.

jsconsumer.Config promised "never" for a zero InactiveThreshold and "the server default (1000)" for a zero MaxAckPending. A stream carrying ConsumerLimits fills both zeros with its own values, so a scaffold consumer can acquire a deletion timer nobody asked for — and a durable deleted that way is recreated from the stream's DeliverPolicy and replays the retained backlog, which makes the cost a replay rather than a gap. Both fields now say so, callers are told to set them explicitly on such a stream and to read the durable's stored config rather than trusting the field, and the MaxAckPending validation text no longer calls zero "server default" unconditionally.

Each claim cites the test that measured it, so the next server bump points at the doc to re-decide rather than at the test to adjust.