Bound the npm remote-tier miss signal (Step 15 observability)

npm.Resolver.Resolve logs one Info record per request when the any-kind finder reports kind=remote and the npm_remote_repositories read then misses. The schema does not require the child row, so that state can persist — and then every request against the incomplete repository emits a record. The log grows with traffic against one bad row rather than with the number of bad rows, which is unbounded in exactly the case someone would be investigating.

Replace it with a bounded signal: a counter keyed on nothing user-controlled, or a reconciliation sweep over kind=2 repositories lacking a binding. Not a per-repository dedupe cache — that was considered and declined, since it needs per-resolver state and an eviction policy to carry the same information a counter carries for free.

Deferred to Step 13 of docs/plans/2026-07-15-npm-remote.md, which the plan already assigns npm-remote observability to. A counter was implemented in !1314 (merged) and reverted there, because S03-B requires a format metric to be declared in its owner spec and S15's metrics table does not define it — so the metric and its S15 declaration should land together, in the step that owns them.

Acceptable until then because the state is unreachable in production: no public route creates a kind=remote parent without its binding, so nothing can drive the amplification. It becomes reachable when the management API gains remote-repository creation, which is the same boundary Step 13 sits behind.

Raised in review on !1314 (comment 3667555173), and removed again per !1314 (comment 3667833056).