test(proof): make the replacement and focus-handoff gates deterministic

`--focus-handoffs` could not pass at all. It auto-selected viewer 2 as the
same-peer replacement target, but viewers 1 and 2 are the handoff
participants, so the replacement tore down a participant's control session
mid-exchange and the run died on "did not observe all handoffs". Replacement
now targets a viewer outside the participant set, and stays off entirely when
the roster has no spare viewer. Requesting an in-set target fails fast with a
clear reason instead of a confusing cardinality error.

Focus participants also left as soon as their handoffs landed, shrinking the
roster underneath any concurrent replacement cycle. They now hold the session
for the full frame budget, exactly like a spectator.

The replacement cycle asserted an exact roster cardinality on every cycle, but
the harness only controls that on cycle 1, which runs immediately after every
viewer attaches and long before any exhausts its frame budget. Later cycles
race the primaries' own exit, so they now assert what same-peer replacement
actually governs: the roster never grows past the configured bound, and the
replacement joined a generation that still has a survivor. This is what made
the three-viewer proof flake under load.

The spectator path reported the roster from a single sample taken at hello
time; it now tracks the maximum across the snapshot stream, as the focus
participant already did.

With the gate working, `verify-demo-build.sh` now runs it, so slot-0 focus
handoff and neutral-before-successor are covered by the release preflight
rather than by hand.

commit

b2e61ed63c2f58e5dd0cd541f95c443c8d46dc9a

parent

9c040f61fa919e1b68f26efa87db8fba09b05b9d

author

Dami <dami.etoile@gmail.com>