fix: end every open run, visibility, and wider round ceilings

[abedegno]

What and why

The remaining fixes from the #768 run, plus the two gaps the codex review of #107 found.

Runs that never ended

• cancel ends a run that has no PR. It recorded cancel_run but never the terminal fact, and waves skipped front-half cancelled runs, so four legacy runs have been open since September. cancel now records escalated itself when the run has no implementation output. It finishes a run an earlier cancel left at cancelled instead of refusing it, checks that the kernel accepted the record, and reads the state back.
• The sweep takes every cancelled run, with or without output. If retiring the sessions or the record fails, the resume path's cancelled case records the fact on the next wave (second codex review).
• The sweep takes back-half runs whatever their output. A pass that died between start_implementation and its output left a run at implementing that no wave found. Resumed, _step_loop adopts the PR the implementer pushed or, finding none, the pass ends the run.
• Every terminal fact is read back. Five record_run_outcome sites retired the queue file on the assumption the fact had been accepted. They now share _finish_pass's read-back (_run_ended), keep the queue file when the kernel refused, and say so in the row.

Seating and cost

• When both vendors are conflicted, the vendor that started the repair implements again (new coordinator.cli implementer). Before, every wave paid for a review that the kernel refused.

Visibility

• no_verdict parks keep their cause. The derivation's note travels as the park's cause, JSON-encoded rather than interpolated, and the issue notice leads with Why:.
• Resumed passes report the run's repair rounds from the journal (spec §2), not just the rounds from their own pass.
• coordinator.cli status / batch/status.sh print each open run's state, park reason, PR, rounds, front-half seats and last activity.

Bounds

• Policy ceilings raised to 1..20 rounds and 4..120 seats; defaults unchanged. #768's plan needed nine rounds, each with distinct findings. A front-half no_progress like the back half's was considered and not built: front-half findings are free text hashed whole, so "the same findings three times" would essentially never fire, and identical_resubmission already stops a looping author.

Tidy-up

• Removed the unused back.repair_for_head. ARCHITECTURE §8 no longer says the repair protocol is missing.

Effect on the merge gate

None. Nothing here changes review, CI observation or merge authorization. Seating changes only which vendor implements when both are conflicted; the kernel's independence check is unchanged and still refuses a conflicted reviewer.

Testing

• bash batch/run-queue.sh --self-test passes (macOS; Linux via CI)
• New behaviour has test cases: queue generation (implementing without output; cancelled without output), cancel ×4 (ends, finishes a legacy run, leaves a PR run to the wave, retire failure), refused-terminal-fact ×2, no-PR resume ends the run, implementer seating, implementer/rounds/status CLI, no_verdict cause (client encoding including multi-byte, runner pass-through, notice), resumed rounds, policy ceilings
• Guards shown red first; the refused-failed test was mutated at its one site (restoring the unconditional retire) and failed

Whole suite: 2021 passed, 3 skipped. Codex review: its one Important finding (cancelled runs stranded if cancel fails partway) is fixed here; nothing else was found.

Anything a reviewer should look at twice

• The sweep now resumes every non-ended run. Deploy order matters for the four legacy cancelled runs (Bircher launch: detached run-queue.sh dies with the exec session (use setsid) #11, feat(bircher): bircher-bot approval to self-merge on protected repos (#10) #12 ×2, harden(bircher): lint-before-CI + PR issue-number mapping fallback + code-naming defense #20). The timer is paused, this is deployed, cancel ends those runs, and then the timer resumes, so no wave relabels those old issues.