docs(backlog): one read of health is not an identity

[G1NG4R]

Backlog only — no code. The night's measurements, including two corrections to
figures I published a few hours ago.

What it carries

• e2e on main runs 12:40 to 34:57, not to 17:38. 944a1e4 took
  34:57 and went green, double the upper bound the entry below claims from
  six samples. Long does not mean red, which also retires the suspicion that a
  long e2e is one retrying a failure. The rule "start the witness as soon as
  e2e is in_progress" survives — it is the only start that still has lead
  time at 35 minutes — but the 1800 s rail does not, so both later runs used
  WITNESS_MAX_SEC=2700.
• A single read of /api/health can report a process that is already gone.
  Nine seconds after the 944a1e4 deploy it reported startedAt 00:39:53.604Z,
  before ops.lastDeploy.at — the first negative offset of the series, and a
  finding-shaped one. Ten samples later the serving process is
  00:40:16.706Z, i.e. +12.7 s, squarely in the known band. During a
  rollout /api/health is balanced across two processes, so one read is a
  sample, not an identity. Same family as the stale-p95 note in docs(backlog): the watcher waited for itself, and p95 was stale #452: there
  the number is old, here the process is.
• Two swaps, both clean: 339 × 200 and 1087 × 200 per path, zero non-200.
  The first witness of the night ran its full 1800 s with no deploy in it; a
  chained successor took over with a 4 s gap and logged the identity before
  starting, so the handover is proven rather than assumed.
• test: the witness tail is measured from the twin, and closes before #304's window #453 now has four data points and the pattern holds: coverage after the
  serving process comes up is 30 s minus the twin gap — 26.6 s → 3.4 s,
  15.6 s → 14.4 s, 16.7 s → 13.3 s, 16.3 s → 13.7 s. The normal gap is around
  16 s; the 26.6 s outlier is the one that shuts the window.
• chore: bump the web-development group in /web with 2 updates #450's red e2e was the chore: two e2e tests flicker, and the deploy gate hangs on the suite they are in #429 count test, and after gh pr update-branch
  the fresh run was green on its own — the one permitted rerun went unused.
  Its premise was checked in .github/dependabot.yml: next, @next/mdx and
  eslint-config-next are held for semver-minor only, so a 16.3.6 → 16.3.8
  patch is what chore: hold the next 16.3 line, by name and with the measurement #445 intended to keep arriving.

The idle-drop tally gains three rows and stands at 6 drops in roughly 35 440
requests, eleven swap runs in a row without one. #304 gains no new evidence
from tonight: four witnessed swaps, all clean.

make check green.