feat(e2e): refute the storage read a conditional tarball must not cost

Adds e2e/internal/logs and closes e2e.npm.remote.tarball-conditional, whose "no storage read" clause had no external signal. The chosen route is a log read rather than a metric: the storage: blob served wide event fires only on a successful OpenBlob, and it is attributable per request, so it needs no serialisation, no single replica and no new profile.

The test picks the correlation id. LabKit takes an inbound X-Request-ID verbatim when it matches ^[a-zA-Z0-9_\\-]+$, and the log sampler only touches records whose message is access, so a wide event is never dropped. Measured: a dotted id is silently replaced, not refused, so every refutation under one would pass — hence AssertEcho.

The refutation takes two bounds, and both are structurally required. A watermark bounds how far back the window reaches (guarding a rolled log buffer) and a landmark proves delivery caught up. Both are Record values obtainable only from AwaitOne, so the positive companion cannot be omitted.

Fail-closed coverage. --tail defaults to 10 lines per pod with a selector, so Logs passes --tail=-1; --since is deliberately not used, since narrowing the window can only make coverage harder to prove. Window.Uncovered names pods whose retained log begins after the watermark and the refutation fails naming them. And a kubectl logs diagnostic arrives on stdout with exit 0, so a window carrying any unreadable line is refused rather than trusted.

The second commit corrects a wrong premise the rig exposed: a cold read is a cache miss and emits no blob_served at all, because OpenBlob runs only on a hit. The bounds are now two different events — blob_committed for the write, blob_served for the read.

Row rig-verified green. Deletes the lifted limitations.md entry.

Justification for 1,237 insertions (guardrail 17, measured at 9fe639cb1): go non-test 744, tests 373, docs 103, scripts 17.

Related to #1289

🤖 Generated with Claude Code