feat(tune): remember what the loop measured, so it stops relearning it

tuning::verify closed half a loop. It measures whether a write helped and
undoes the ones that hurt, and then nothing consults the result: the next
cycle proposes the same setting, applies it, measures it, and reverts it
again. Forever. Two writes and several seconds of sampling per interval, on
a machine flapping between two configurations, with an audit log filling up
with the same pair of entries.

Feedback that reaches the revert but never the decision is not a closed
loop. This is the missing half.

`Ledger` records verdicts per setting id and gates future proposals:
regressed is never retried, unchanged is not re-measured, improved is
already in effect. `serve::cycle_verified_with` takes one and withholds
gated settings with a reason naming what was measured.

Unverifiable is deliberately not a gate, and that exception is the load
-bearing part. The metric registry is empty, so every setting is currently
unverifiable; if "could not tell" counted as a result, the first cycle would
record it for everything and the loop would never act again — a tuner
stopped permanently by the absence of a measurement it never had. Tested
directly.

The ledger is owned by the caller rather than kept in a static. Hidden
global history is what makes an autonomous agent impossible to reason about,
and a caller that can inspect, serialise or clear it can answer "why did it
do that" without reading the source.

Nothing here is permanent: a regression measured on an idle Tuesday is not
proof about a busy Friday, so `forget` and `clear` exist and attempts are
counted. What it prevents is relearning the same thing every sixty seconds.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>