run-journal: raise event ceiling to 2048 with doctor headroom warning (approved #635 design) and fix measurement deliverables

[solomonneas]

The #635 measurement and design decision is graded APPROVED: events are the binding constraint (worst case hits the 512-event ceiling at 5% of the byte bound; roster-sized load reaches 30%), so raise the bound rather than segment. This issue is the approved implementation plus corrections the grading review found in the measurement deliverables.

Implement (per the approved decision on #635)

1. Raise MAX_JOURNAL_EVENTS 512 -> 2048; keep MAX_JOURNAL_BYTES at 8 MiB. Append and bounded-reader limits move together (they share constants since fix(run): harden journal durability #624).
2. Doctor soft threshold: WARN "journal event headroom" at 75% of the event bound; hard refuse-to-append only at the ceiling.
3. Upgrade recovery for a run stopped at old sequence 512: readers accept the file under the new ceiling, doctor bound-exceeded FAILs clear, append continues from 513 under the active lock. Test this exact path.
4. Keep segmentation as the documented escape hatch, re-triggered if roster-sized runs pass ~50% of the raised ceiling (watch Enforce declared run budgets: ceilings, run_budget lifecycle events, cascade allocation #593 budget events).

Corrections to the #642 deliverables (same PR or a sibling)

• docs/phase-635-journal-ceiling-decision.md:35 overstates byte headroom ~4x: "~20x headroom at 2048 median events" is actually ~5x at the measured 821 B/event (the 20x figure is the 512 value, mislabeled). Fix the arithmetic.
• The stored-artifact acceptance criterion is unmet: .brigade/measurements/ is gitignored, so only the issue-comment transcription exists. Commit the artifact under a tracked path (for example docs/measurements/ or tests/fixtures/measurements/) with its sha256.
• The measurement harness fails open: every scenario exception is swallowed into stopped_reason, which no test inspects, so a silently broken scenario reads as "plenty of headroom". Add a test pinning the ceiling-detection path and make unexpected scenario exceptions fail the run.
• scripts/measure_run_journal.py:221/:232: _count_journal_events aborts the survey on exactly the unreadable journals its docstring claims to survive; move the read inside the try.
• The worst-case scenario row advertises "8 pause cycles" that contributed zero events; make pause cycles actually emit pause/resume facts or drop the label.

Refs #635, #642.