feat(realtime): RT-3 — RING_CAP 2048→8192 + eviction-fatal proof (RT-G2)

Raise the delivered-hash ring cap so the F5 availability edge (a deep 409
step-down reaching a size-evicted ring height) is unreachable within the B1
finalize-defer bound. With the production default (`finalizeDeferMaxMs` 600 s):
600000 ms / 8192 ≈ 73 ms, so any chain with a block time ≳75 ms cannot grow the
window past 8192 blocks above the deferred anchor before B1 fires. A
Map<number,string> of 8192 ~66-char hash entries is about a megabyte, negligible.

Corrects the F5 CANDOR comment: at a >RING_CAP window the EVICTION fatal
("no delivered-hash ring entry for the resume parent") fires FIRST — the moment
the no-match descent lowers cursor−1 from the retained (highest-RING_CAP) band
into the size-evicted band while still ABOVE the finalized floor. The floor
fatal fires only when the whole window fits under RING_CAP (nothing evicted) so
the descent reaches the floor.

Two mutation-verified tests (RT-3 / RT-G2), reusing the scripted /stream 409
step-down harness:
- headroom: a ~4096-block window FITS under 8192 (no eviction) → the no-match
  descent reaches the FLOOR fatal, asserting NOT the eviction fatal. Mutation
  (RING_CAP→2048): the 4097-entry window evicts the lowest 2049 heights 0..2048
  (including the seed anchor at height 0), the descent hits the evicted
  predecessor at 2048 (above floor 0) → flips to the eviction fatal
  ("no delivered-hash ring entry for the resume parent at 2048") → both asserts
  fail.
- eviction: a >8192 window (8200) evicts heights 0..8 → the descent reaches an
  evicted (above-floor) height and throws the LOUD eviction fatal. A sentinel
  connection (NEVER-EVICTED marker) follows the provisioned 409s: at CAP=8192
  it is never reached; under the neuter mutation (remove the loop-top
  missing-ring throw) the descent exhausts every scripted 409 and trips the
  sentinel → a loud, fast failure instead of a 15 s Vitest timeout.

Also aligns INVARIANTS.md (INV-10 realtime linkage, the DELIVERED-HASH RING
clause, and the F5 doc-candor entry) to the corrected mechanism and the 8192
cap — invariant catalog kept exact.

Both-version Portal gate green (0.16.6 + 0.15.17: 358/358 each); biome clean.
Mutations re-verified: RING_CAP 8192→2048 flips the headroom test to the
eviction shape; neutering the loop-top throw trips the NEVER-EVICTED sentinel
(fast, not a timeout).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dzhelezov