fix: the window says when a run's record will be too big to read back

[donislawdev]

Stacked on #80. Closes observation O184.

The command line has warned about a record too big to read back since the
ceiling was measured. The window said nothing at all - TooLargeToReadBack
had two callers and not one of them was in internal/gui.

Somebody who generated 25 000 files from the window ended up with a directory
that tfg verify and tfg cleanup both refuse, and no warning anywhere. The
manifest is the only authority over what may be removed, so those files could
never be cleaned up by this tool again.

It is the kind of parity gap D1 loses most easily: not something the engine
can do from one surface and not the other, which is what the parity guard looks
for, but something one surface says and the other does not.

The recorded diagnosis was wrong, and that was most of the work

O184 recorded this as a question about the manifest schema - notes are per
file, this one is per run. That premise is false. The command line does not
read this off the manifest either: it works it out from the plan and prints it
before the first byte, and manifest.TooLargeToReadBack was put where it is
exactly so the two surfaces could not disagree about one run.

What was missing was a caller. The schema does not move and
manifest_version stays 1.0.

One method arrives, (*Manifest).ReadBackReach, because the count of entries
carrying a note is already kept while entries are added - working it out again
would mean walking every file a second time and getting it subtly wrong when a
failed entry gains a note of its own.

Two places, because the window cannot speak mid-run

A widget touched from a worker is a race, and two of those were found on CI.

• After Preview, the window's answer to --dry-run. engine.Run with
  DryRun builds the whole document, so the answer is there for the asking.
• When a run finishes, immediately after the line saying what the run did
  and ahead of any other note. This is the one that matters - Preview is a
  button somebody may never press, and that person is the one left with the
  directory.

Guards

Four guards, four mutations, all caught.

The Preview pair was written wrong first, and a probe said so. It set a
200 B size while the window was on its default format - the first in the
registry, which is avif - so both previews were refused. The negative half
passed while proving nothing: a screen saying "check the settings marked above"
says nothing about a manifest ceiling either. Both now choose txt, and both
assert the preview was accepted before reading anything into what it said.

The guard for a finished run costs 26 s because it really writes 22 345
files. runFinished has no cheaper seam, and it is the only guard covering the
case the observation is actually about.

The fourth guard asks a separate question: do both surfaces judge the same run
the same way at the boundary. Two paths to one number are allowed only
because they go through one predicate, and this asserts it rather than trusting
it.

Full suite green, preflight --quick green.

🤖 Generated with Claude Code