pbz: Chunk 30 second review pass — keep the transport error, soften the loop

Re-review of the first fix round found one regression it introduced and
several things it missed.

The regression: run()'s new hard throw discarded protocol.mjs's own
error and replaced it with a generic message, losing the device address,
the close code and the recovery pointer. That undid Chunk 29 on this
path, and it reaches `pbz power <pattern>` as well as `pbz run`. A
transport death now propagates untouched; the generic message is
reserved for an actual timeout.

The completion-ack loop could turn a landed write into a hard failure if
the device sent fewer acks than chunks. Only the first ack is required
now; the rest are best-effort, so a short count under-claims instead.

The premise that frames prove rendering was load-bearing and unverified.
Measured: a rendering device returned 10 frames at once, a paused one
returned 0 in 4s. It holds in both directions.

Also: the comment stating the honesty rule said "before the send" while
the code (correctly) does it after; a dead `resumed` store contradicted
the note saying it had been removed; and the .d.mts still carried both
claims hardware overturned, on the published contract a caller reads in
their editor.

Test fidelity was the root cause of two of these surviving: the fake now
derives chunk acks from the real payload and honours the watermark.
Mutations that collapse the ack loop or drop its mark are now caught.

24 new tests, 216 total, typecheck green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PZnUXRsLLnt2A7pR3X4Luj