feat(tune): close the loop — measure whether a setting helped, revert if not

`tuning::verify` measures a metric before a write, waits a settle period,
measures again, and reverts on a demonstrated regression.
`serve::cycle_verified` runs a tuning pass that way; each `AppliedOutcome`
carries its `Verdict`.

5.1.0 made writes reversible and left nothing to decide whether to reverse
them. A tuner that can apply and undo without telling the two apart is
still guessing, it just guesses in both directions.

The metric registry ships empty, and that is the substance of this commit
rather than a gap in it. The natural metric for a CPU power-scheme change
is achieved clock speed, and on Windows there is no such reading:
`CallNtPowerInformation(ProcessorInformation)` reports a nominal figure.
Measured — 16 spinning threads took system idle from 79.7% to 11.4% while
every core reported exactly 4400 MHz throughout, before and after. A
verifier built on that would have reported "no change" for every power
scheme in existence and been believed. So `active_scheme_guid` gets no
metric and the honest output is `unverifiable`.

`Unverifiable` is therefore the default verdict, kept distinct from
`Unchanged` — "we looked and could not tell" is not "we looked and found
nothing" — and from `verdict: None`, which means nobody looked. Only a
measured regression reverts: undoing on "I could not tell" would reverse
nearly every write this crate makes, which ignores the measurement rather
than using it safely. Noise is handled by comparing medians of sampled
windows against the larger of the declared minimum effect and the scatter
the windows actually showed, so a jittery metric raises its own bar.

`revert_cycle` skips writes verification already undid; reverting a revert
restores the value just measured as worse.

The decision path is driven by a scripted metric and injected writes in
tests, so the branch that matters — a regression actually causing a revert
— is exercised without needing a registered setting on real hardware. That
gap is what let a one-way write path look complete before.

14 new tests. Full suite green with and without --features vault, clippy
clean, builds on the declared 1.88.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>