fix(orchestration): don't plan a music unit that can't fit before a handoff (gh-#300)

[genwave-radio]

Addresses #300 (the observed incident and the fit-logging half). The remaining band is #320.

🕓 The fault

The 2PM handoff aired at 2:05. #254's fit biases which track fills a unit; it has no move for "don't plan another unit at all." At 19:59:29 the queued audio already ran past the boundary, so desired was deeply negative, every candidate overshot, and the least-late branch answered with a full ~3.5-minute track. That one unit is the entire slip.

🎚️ Scope — one rung of three

Dean's field note reframed this, and the PR is scoped honestly to match:

room left before the boundary	move	here?
enough for a track to fit	plan it — ceremony lands at the seam	✅ already shipped (#254)
positive, but nothing fits	straddle — sign off now, track crosses the hour, sign on after	➡️ #320
already negative (queued audio past the boundary)	ceremony now, no music	✅ this PR

This does not close the whole class, and an earlier draft of this description wrongly said it did. With ~100s of room and 3.5-min tracks the floor doesn't trip, the fit plans the least-late track, and the ceremony still lands ~1:45 late. What this PR does is fix the incident that actually aired (room was deeply negative) and bound the rest: worst case moves from ~5 minutes late to ~2. The floor is documented in-code as interim, and should collapse toward zero once #320 owns the middle band.

Raising the floor instead of building #320 doesn't work: it converts a late sign-on into an early one — "it's two o'clock" at 1:57.

🛠️ The fix

Under a 90s floor the ceremony becomes the unit. Two details make it correct rather than merely earlier:

1. The drain runs as-of the BOUNDARY, not "now." A SignOff comes due at boundary − SignOffLeadTime, so at the instant the decision is taken it's still 15s in the future and an as-of-now drain returns nothing — precisely the bug. As-of-boundary also keeps both halves in one TryDequeueDue call, the documented common shape.
2. Planning early is not airing early. The ceremony queues behind QueuedAheadMs of audio still draining, so it reaches air at the boundary.

Handoff kinds only — an ident is imaging that rides the next seam happily. Never-silent (F6.3) holds: the decline only ADDS segments, and a ceremony that renders nothing returns null so the pull plans an ordinary music unit as if the decline never fired. There's a spec for that.

🔭 The observability half

Every fit now writes one line carrying each term it reasoned from:

Boundary fit (SignOff) — untilBoundary=45.0s queuedAhead=200.0s preMusicPatter=0.0s
breakPatter=0.0s desired=-155.0s tolerance=±30.0s confidence=Heuristic
sampled=[] chosenDiff=n/a outcome=declined (floor=90s)

⚠️ Information, not Debug — and that detail is the point. I checked what the fleet actually ships before writing it: there are zero dbug: lines in Loki. The existing per-pick "Pick —" Debug line has never been visible in production, which is why this was undiagnosable beyond render archaeology. A Debug fit line would have satisfied the issue's letter and none of its purpose. This is also the instrument that will measure #320's band.

✅ Verification

• Build clean, 0 warnings
• Full suite: 2,559 passed, 0 failed (12 new specs)
• Negative control: with the floor disabled, 6 of the 12 fail — and exactly the 6 that should hold regardless (room-left, ident, never-silent fall-through, engaged-path logging) still pass. The specs fail without the fix.

Boundary timing is an ear check in the end — worth listening to a handoff once this ships.