fix: work the sustainable current from whichever ambient leaves less headroom

[zebraengine]

Problem

Two failures of the ambient behind sustainable_max_a, same evening, opposite directions:

1. End of the 32 A probe (18:38): the trajectory-implied ambient named 47 A; the sensor's 30.25 °C named 44 A, which is what held. The current law extrapolated to 32 A over-reads the rise by ~2 °C, and the error comes back doubled when rescaled to 47 A. feat: fit how rise scales with current, and restore straight to the sustainable rate #31 fixed this by preferring the sensor.
2. Restart at 20:38, 1.7 h after a 55-min charge: the sensor read 25.6 °C but the handle's trajectory implied 28.7 °C — the cable and wall were still heat-soaked. The sensor route named 48 A; the implied route (and suggested_max_a) named 46 A, which is right.

So "sensor first" is optimistic on a warm restart and "implied first" is optimistic after a low-current probe.

Code touched

• wallmonitor/thermal.py predict(): sustainable_max_a is worked from whichever of the two ambients is warmer — i.e. leaves the handle less headroom. sustainable_ambient_source says which won ("measured" / "implied"). On model basis the implied ambient is the model's ambient, so nothing changes there. suggested_max_a untouched (implied, as before).
• Docstring in sustainable_max_current, the amp-control module docstring, and docs/amp-control.md updated to describe the rule and both incidents.
• tests/test_wallmonitor.py: sensor cooler than the trajectory implies → implied wins (42 A); sensor warmer → sensor wins (< 42 A). Existing trajectory test asserts sustainable_ambient_source == "implied" with no sensor.

Risk

• Strictly more conservative than either source alone: the restore target can only be equal or lower than under feat: fit how rise scales with current, and restore straight to the sustainable rate #31. Worst case is a jump landing 1–2 A under the true max, which the ladder then tops up.
• Early in a trajectory window the implied ambient can be wild; the controller only restores on trajectory-clear with confirm ticks and margin, and its ladder-step floor (max(step, sustainable)) bounds a tiny value. Unchanged from feat: fit how rise scales with current, and restore straight to the sustainable rate #31.

Verification

• uv run pytest: 153 passed (one new).
• Both incidents replayed by hand against the rule: probe end → max(30.25, 27.3) = 30.25 → 44 A; warm restart → max(25.6, 28.7) = 28.7 → 46 A.

Deploy: pull + sudo systemctl restart wallmonitor.service. Server-only.

🤖 Generated with Claude Code

[zebraengine]

Superseded: the backtest in #34 shows every ambient-selection rule sits under a 3–5 °C model error that grows with ambient. The model gets an ambient term instead; the restore ambient gets re-evaluated with numbers after that.