feat(saturation): configurable tuning knobs; deprecate stop_after_failures

[brayniac]

Summary

Design-limitations #5 and #6 — both small cleanups to the saturation config.

#5 — promote the search's hardcoded tuning constants to optional config, all defaulting to their current values (zero behavior change unless set):

• confirm_windows (default 3) — windows used to confirm the final boundary (M-of-N); higher is more noise-robust but slower. Threaded into SearchPlanner (replaces the CONFIRM_WINDOWS const), clamped to ≥ 1.
• drain_settle_ms (default 500) — settle time after draining before measuring a rung.
• drain_timeout_secs (default = sample_window) — max wait for in-flight to drain before measuring a down-stepped rung.

#6 — stop_after_failures is dead since the bisect+confirm rewrite (#145). It can't be removed outright because SaturationConfig is #[serde(deny_unknown_fields)], so a config still setting it would be rejected. Instead it's now Option<u32>, parsed-but-ignored, and a warning is logged if a value is present, telling users the knob no longer does anything.

The example config documents the new knobs and the deprecation.

Test plan

• cargo test — 99 lib + 16 integration tests pass, 0 failures (planner convergence tests still pass with the now-parameterized confirm_windows).
• cargo clippy --all-targets — clean
• cargo fmt --check — clean
• Behavior-preserving: every new field defaults to the prior constant; stop_after_failures was already unused. The deny_unknown_fields interaction is safe — the field still exists (as Option), so old configs that set it deserialize fine.

Generated with Claude Code