test(converge): derive each convergence budget from the bound it races

Replaces the hardcoded `for _ in 0..600 { sleep 25ms }` spin — a 15.0 s
budget stated nowhere and justified nowhere — at 31 call sites across four
files: mesh (9), mesh_recovery (6), pump (7), registry_lifecycle (9). All
now call `spt-test-support::converge_within(budget, ...)`: one shared loop,
with the budget passed per site.

Each budget is DERIVED from what that site actually races, and the same
const feeds both the rig knob and the budget, so the two cannot drift:

  - TEST_DIAL_BOUND (1.5 s) x 20 — sites racing a dial. The const also
    feeds net_broker_with_dial_timeout (mesh_recovery, x2) and
    set_quic_op_timeout (pump, x2).
  - 500 ms x 60 — sites racing the roster settle.
  - PUMP_REGISTRY_CADENCE (100 ms) x 300 — sites racing a registry tick
    (mesh, registry_lifecycle).

All three land on 30 s: 2x the old implicit budget, and half the 60 s SLOW
line, so a site that needs its full budget still does not read as slow.

On failure the loop prints budget, elapsed, sample count and last observed
state, instead of a bare assert. mesh_recovery names its per-site
predicates; the remaining 25 sites keep a bare bool with the limit STATED
in-file, and a comment pointing the next red at the loop. That is a
deliberate stop for a reviewable test-only change, not an oversight.

Behaviour held fixed: predicates are untouched, retention is taken at every
sample, and live_peers > 0 remains required.

Not a defect, so the next grep does not re-raise it: the two remaining
`Duration::from_millis(500)` in pump.rs (:913, :920) are Brain::cold_start_pump's
third argument — a different knob, not the dial bound — and are correctly
left alone.

Two self-caught defects in this change, both recorded because they are the
evidence that the census was real:
  - Doc comments still quoted the old `0..600` shape after the code no
    longer had it; a grep for the old shape matched the DOCUMENTATION about
    it rather than the thing, reading as three surviving sites.
  - One bare 500 ms literal sat beside the very const introduced to replace
    it — a const the knob does not use is just a second literal, authored
    ten minutes after noting that exact hazard.

Census at this sha: `0..600` in non-comment code = 0 across the four files;
bare dial literals = 0.

Co-authored by: hertz