Record the coverage join: detection power and cost refusal are orthogonal axes

[gunbai-bot]

One annotation on gunbc.witness_row_cost. No behaviour change.

What it records

Two instruments were run against the same corpus on the same day and disagreed completely about one cluster:

• A mutation battery answers does this row red when its subject breaks — run in a session, where rows run to completion. Result: across four clusters, exactly one mutation reds nothing where its cluster should discriminate it (a dangling DeclarationRef bind).
• A budget-refusal census answers which enrolled rows were killed on cost before they finished. Result on the same day's main run: 131 BUDGET-REFUSED identities — including all 28 rows of the decl_facts reflection cluster the battery had just measured.

A row that is sharp in a dispatch and killed on budget in CI is undiscriminating in CI, however good the row is. So a battery alone overstates coverage, and a budget census alone says nothing about whether the surviving rows discriminate anything. The coverage claim is the join: rows that both complete and red when their subject breaks.

Two disciplines the battery half needs

Both learned by getting them wrong first, and recorded so the next reader doesn't:

• An empty run is not a green run. An entry passed with no function selector runs zero rows and reports zero failures, which is indistinguishable from a cluster that survived every mutation. It produced three false lines before being caught.
• Reds-nothing is not fails-to-discriminate. A construction census that ignores a changed field value, or an edge claim that ignores a changed body, is answering the question it declared. Four of the seven measured zeros were scope, not gaps — counting them would have inflated a one-entry list into five, four of them inventions.

What it deliberately does not do

It does not restate the threshold number. witness_row_cost_migration_threshold_note already derives it from gunbc_ci_fast_lane_eval_budget_ms, and a second hand-maintained copy is the duplicate authority DESIGN §3 forbids. This row asserts only that cost refusal and detection power are orthogonal axes and a coverage claim needs both.

Note on CI: main's witnesses job is currently red for reasons that predate this branch (#8423 un-masked budget-refused rows), so this PR's checks will inherit that. This diff is a single data annotation and cannot reach any executing row.

[gunbai-bot]

CI red at a92eb24 is not this PR's, and the one PR-only entry was budget noise, proven by re-execution rather than argued.

First run (32155779798): 137 failing identities -- 130 BUDGET-REFUSED, 6 STALE-QUARANTINE, and exactly 1 FAIL not present on main:
where_refinement_enforcement_witness.where_refinement_cast_literal_oci_other_digest_algorithm_accepts, "cost is exactly 1505ms against 1500ms" -- 0.3% over.

Same row, other observations of the same bytes: 1364ms on the #8440 run, and 1274ms on the rerun of this exact frozen merge ref. So it sits at ~85-100% of ceiling with ~15% run-to-run variance, and this PR adds one String annotation to a different module.

After the rerun: 136 failing identities, set difference PR-minus-main is EMPTY. Every remaining failure is the enrolled-row/budget-refusal join un-masked by #8423.

I did not tune anything toward 1500ms. The ceiling is a declared rung drop against the operator's 500ms hard / 100ms warn rule, not a target to fit under, and a row that flips on noise is a cost fact to report, not a diff to absorb.

— sent from sharp-raven-273