sleep: wire the HR-only spine, on a percentile anchor rather than the median - #1806

… median

Wires hrOnlySessions into the day scan for a strap with no motion, and fixes a real flaw in the
merged spine that writing the tests exposed.

THE ANCHOR. hrOnlySleepRuns took its band from hrBaseline, the window MEDIAN, on the reasoning that
reusing the motion path's definition was parity. That was wrong, and wrong by arithmetic rather than
by tuning: a median splits the samples in half by definition, so a band of median * 1.05 admits
strictly more than half of ANY window. Measured on a realistic 24 h - 16 h awake at 74-96, 8 h night
at 59-70 - it called 14.4 hours sleep against a truth of 8. hrSleepBandMult is correct where it was
designed to be used, as a CONFIRMATION gate on a run gravity stillness already found, where being
permissive is deliberate. A confirmation threshold and a detection threshold are not the same
instrument.

Now anchored on hrOnlyBaseline, the tenth percentile by nearest rank, which sits in the night's
trough and cannot admit half a window however the day is shaped. Chosen from a sweep over anchor x
multiplier against windows with known truth, taking the conservative corner because the two failure
directions are not symmetric: over-detection puts a wrong Rest on screen, under-detection leaves "No
data", which is the state this improves on. p10 x 1.05 measures 8.1 h against a truth of 8 on a
field-shaped day and under-reads a 54 h two-night window rather than over-reading it.

MERGE THE RUNS. A run boundary is a threshold crossing and a sleeping heart rate oscillates across
the band all night, so the spine returned the night's minutes shredded into sub-mergeMin fragments,
every one of which then failed the minimum-duration gate - 8 h of detected sleep yielding zero
sessions. mergePeriods first, exactly as the motion path does.

DISPLAY-ONLY, ENFORCED STRUCTURALLY. An HR-only night carries NULL restingHR and avgHRV, and the
AnalyticsEngine enrichment that would refill them now skips it. Those two values are what Charge and
the baselines fold in, and a baseline is the one thing a false positive cannot be unwound from.
Withholding them is structural; a downstream filter would be one forgotten call site from failing
open. The Swift enrichment also now names hrOnly when it rebuilds the struct - unlike Kotlin's copy,
that rebuild drops a new field by default.

A 4.0 IS UNTOUCHED. The fallback sits behind grav.size < 2 and only when the device persisted no
hypnogram of its own, so a strap that banks motion keeps the motion spine - a working detector must
not be replaced by a weaker one. Pinned by a source-reading test.

Two comments corrected that this change falsified: the no-motion diagnostic no longer claims the
stager has no HR-only fallback, and the Apple day-cache no longer justifies itself on "a WHOOP
always streams gravity".

18 Kotlin tests, 0 failures. Swift twins compile; the package test binary cannot link GRDB's sqlite3
on Linux, so CI runs them for real.

Refs #1801.

Re-review, and the finding is the exact failure this PR claimed to have designed out.

The display-only guarantee rested on an HR-only session carrying NULL restingHR/avgHRV. That only
protects an aggregate that READS those fields, and two of the day's physiological aggregates do not:

  - the deep-window HRV pool re-derives RMSSD from `rr` over each session's own stages;
  - the SDNN index filters `rr` to the matched session windows.

An HR-only night HAS stages, so both would have folded one in — and from there into Charge and the
HRV baseline, which is the one thing a false positive cannot be unwound from. deepHrvWindow is a user
setting (UnitPrefs.hrvWindow == DEEP_SLEEP), so that path is reachable rather than theoretical.

Fixed by naming the set once — physiologySessions = matched.filter { !it.hrOnly } — and routing all
four aggregates through it, rather than adding a filter at each site. The scattered version is what
produced this bug: I wrote "a downstream filter would be one forgotten call site away from failing
open" and then forgot two.

`matched` keeps its legitimate uses in analyzeDay — duration, stage totals, Rest, the onset — which
is why the guard checks the physiological region rather than banning the name.

Guarded by a source-reading test, deliberately rather than a behavioural one: the failure this
protects against is a FUTURE aggregate reaching for `matched` out of habit, and a behavioural test on
one path would not catch that. 20 Kotlin tests, 0 failures.

…e percentile twin

Re-review, two findings.

WakeMotionRefinement rebuilds a SleepSession field by field on Apple, so it dropped hrOnly by
default; the Kotlin twin is a `copy` and preserved it for free. Refinement only ever sees
motion-detected sessions today, so an HR-only night never reaches it — but the two platforms would
have disagreed silently the moment it did, and a flag that decides whether a night can touch the
baselines is the worst one to lose quietly. This is the second time in this PR that Swift's explicit
init dropped the field where Kotlin's copy kept it; both sites now name it.

The percentile index is now pinned against the Swift twin's own stdout across the sizes where a
nearest-rank rule can disagree: n below 1/p, and either side of an exact boundary (1, 2, 3, 7, 10,
11, 99, 100, 101, 1000). Both platforms truncate toward zero, so they agree — but that is now
asserted rather than reasoned, since a rounding rule is exactly the kind of thing that reads
identical and diverges.

21 Kotlin tests, 0 failures.

app-build caught what nothing else could. Strand/Data/IntelligenceEngine.swift is the day scan and
lives OUTSIDE the StrandAnalytics package, so an internal entry point is invisible to it:

  Strand/Data/IntelligenceEngine.swift:1182:39:
  error: 'hrOnlySessions' is inaccessible due to 'internal' protection level

Both app targets failed on it while every default CI job stayed green, because none of them builds
the app target — `swift build` compiles the package, where internal resolves fine, and that is what
I had been checking locally.

Only the entry point is promoted. The spine, the anchor and hrOnlyBaseline stay internal: the tests
reach them with @testable, and nothing outside this package should be assembling its own spine.