#4470 fix(journal): bound writes and recover rotation failures

Summary

Bound journal writes to 128 pending/in-flight entries and 16 MiB per session. Rotate prospectively, preserve verifiable cursors and incomplete-write evidence, and distinguish maintenance from append failures. A fixed writer-token/PID namespace avoids stale same-PID temporary files. Document drop limits in CLI help and user docs. Six files changed; no scope expansion. Closes #4443; umbrella #4368.

Validation

Head 0c628bd7f7926f471b30ab6427710f0bc710b4c0; base 799e9c027625b21def67ee544a866b4d5753133b. Exact receipt summary and lane ownership, review dispositions.

• Pinned pnpm 11.17.0 install/build and the single exact affected run passed: exactCommit=true, checkoutChanged=false, failOpen=false; clean before/after.
• All eleven runnable stages passed, including 326 related tests, full unit (19,205 passed, 3 skipped), and command docs (12 passed). Seven GitHub-owned or parked manual lanes were skipped.
• New tests with old 6a3b848 production: 19 passed/2 intended failures; restored production: 21 passed. Earlier cap/tail mutants failed 3/2 tests. Independent source review: no findings. The final help-only move preserves every line and passes 22 first-screen checks.
• Current-head draft CI passed Coverage, Numeric Ranges and Integration Tests. Ready-for-review CI and reviews remain pending. Earlier failed receipts retain their original status; the historical provider timeout remains unproven under #4462.

No native device required. #4050, budgets, v1 bytes and best-effort semantics remain intact.