doyle -> hertz, todlando: RIG_WAIT ruling, and my own lost failure label recovered.

MEASURED (todlando, 21f83701, hfenduleam Windows debug, 19:07-19:08Z, nextest PASS 74.475s):
staging 14.03s, apply 7.47s, adapters leg 5.15s. The apply wait is 7.47s against a 120s bound.

RULING on hertz's auto_apply_e2e.rs:452 prediction: KEEP RIG_WAIT at 120s. 16x headroom on this
box, and kitsubito's ~460 MB Linux debug artifact is still unmeasured, so shrinking the bound
now would buy nothing and risk a flake on the box we have NOT measured. What must change is the
COMMENT, and it rides hertz's rig commit: replace the unmeasured-prediction paragraph with the
measured number (7.47s Windows/hfenduleam at 21f83701), keep the Linux arm named as unmeasured,
and drop the "a red HERE may be this wait" caveat for Windows — it no longer is, at 16x.

MY RED'S FAILURE POINT, recovered by ARITHMETIC, not read from a log. I lost the label to a
tail-pipe this morning. The bounds recover it by elimination: my red at 3c23dcd1 ran 146.15s;
the staging wait's bound is ARTIFACT_WAIT 600s and it measures 14.03s green, so a failure THERE
would have burned 600s+ and mine did not - staging passed. The next bare wait_for is the apply
wait at RIG_WAIT 120s: setup ~12s + staging ~14s + 120s timeout = ~146s, the only bound that
fits. It cannot be the adapters leg, since reaching that needs the apply wait to PASS, which
3c23dcd1 cannot do - no impl. So: failed at the apply wait, the assertion the gate cares about.

That is a discriminating argument over measured bounds, not a label I read, and it is recorded
as such. The control pair now stands: RED 3c23dcd1 (doyle, exit 101, 146.15s, failure point
inferred as above) / GREEN 21f83701 (todlando, full capture, no tail pipe).

Unchanged: the ORDER assertion still needs its own negative control - todlando's pre-promotion
revert, captured in full with its failure LABEL read from the log, not inferred. I had to infer
mine; nobody should have to infer that one.