[CMGS]

Root-causes and fixes the two flaky tests on the v0.1.31 round's open list. Both causes are on the test side; no product behaviour changes.

TestChangingTheLimitMovesAnOpenTunnel (egress; 2/40 under -race on linux/arm64)

• Cause: a limit switch lets through the unlimited copy chunk already in flight. kick sets a past read deadline, but splice checks it only between chunks.
• Diagnostic (40 runs of a throwaway test counting sink bytes after the switch):
  • normally +255 KiB at the switch, which is the new bucket's burst, then 256 KiB/s;
  • one run moved +563 KiB within 1 ms, and that crossed the test's 512 KiB target at once.
• Fix: the test measures the new rate from 50 ms after the switch.
• Docs: egress.md and the SetLimit doc say the switch lands once the chunk in flight is through. The comment is edited in place.
• Evidence:
  • 0/40 under -race on linux/arm64;
  • the mutant without kick() on SetLimit fails 3/3.

TestDisablingARunningClaimRevokesItsPacketPath (pool; under full-suite load only)

• Cause: the claim's first tun_up runs in a goroutine. A disable that beats it records down, up, down; the arm goroutine re-checks and downs the guest again, so the guest ends down, which is correct. The test waited for exactly up, down. Forced with tunUpGate, the verbs are [down, up, down].
• Fix: the test waits for the first tun_up before it disables.
• New test: TestADisableBeforeTheFirstTunUpLeavesTheGuestDown pins that convergence.
• Evidence:
  • 0/20 under -race on linux/arm64;
  • the mutant without the re-down after a late tun_up fails it.

Cost. Tests and docs only.

/simplify: test-only diff of +28/−6. Nothing to fold: the egress fix reuses waitBytes and the tun fix reuses tunVerbsOf and doorOpen.

Gates (fail-fast ship script):

• lint 0 issues. on darwin and linux; fmt clean; asl clean;
• race green on darwin and on linux/arm64, except the container-only utils test;
• comment delta +1/−1, the in-place SetLimit doc edit.