Fix ingest/capture edge cases (burst 3)

[REPPL]

Summary

Burst 3 of the autonomous correctness hunt — 4 low-severity bugs, each with a watched-to-fail regression test. Several are second-order refinements of the burst 1 fixes, which is the expected shape as the hunt digs into deeper edge cases.

• validate rejected a finding at t<0. An imported recording whose creation_time predates the manifest t0 yields legitimately-negative session-relative times; a faithfully-anchored finding then failed the whole transactional ingest. The lower bound is now derived from the earliest timeline entry (symmetric with the upper bound); a normal session still floors at 0.
• appendLines could still persist a newline-less line on a full disk. os.File.Write gives no atomicity, so ENOSPC lands a truncated prefix — which then breaks merge on the whole file. New appendRecords records the length and Truncates back on any write error; corrects the earlier comment's false atomicity claim (from burst 1's demo fix).
• An empty findings array silently truncated a prior good findings.jsonl (O_TRUNC write) — a model that finds nothing, or a truncated answer file, wiped real data. Ingest now refuses an empty answer.
• The overwrite guard counted only enum-valid verdicts, so a hand-edited file whose only verdicts carried a foreign value was clobbered on re-ingest. It now counts raw kind:"verdict" lines.

Docs + DECISIONS.md updated in step; all gates green independently.

Stacked on #17 (bughunt-2), because burst 3 hunted against the burst-1+2-fixed tree so its findings are genuinely new. GitHub will retarget this to main when #17 merges.

Convergence note

Bugs per burst: 5 (one HIGH) → 2 (LOW) → 4 (LOW). The severity ceiling has dropped to LOW and findings are increasingly niche (disk-full, imported-recording clocks, empty/hand-edited answer files) and second-order. Real, but we're into diminishing returns — see my message for whether to keep going.

Assisted-by: Claude:claude-fable-5