review: adversarial pass — fix ROI leak for overturned rows + load-gen guards

Two defects found and fixed in a hostile review of the whole package:

1. The ROI report generator trusted the ledger verdict field and would
   mint a clean $16,886/year report for phase2-comrak-010 — the
   memory-leaking patch the audit overturned (immutably 'accepted' in the
   append-only ledger, sanitizers_clean:false). report_row now exposes
   sanitizers_clean and the report treats accepted-but-not-sanitizer-clean
   as NOT shippable, printing a warning before any dollar figure. Legit
   wins (sanitizers_clean:true) still render clean.
2. bench-runner service --rate 0 / --count 0 could panic via
   from_secs_f64(1/0); run_session now guards finite/positive rate and
   non-zero count/workers.

Attacks correctly refused (verified, no change): ledger UPDATE/DELETE,
propose_patch ../ + .git escapes, read_target_source traversal. All 10
accepted rows satisfy the green-gates + CI>=1.02 invariant. Findings
recorded in results/adversarial-review.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

crates/bench-runner/src/service.rs

@@ -189,6 +189,15 @@ fn one_request(port: u16) -> std::io::Result<()> {
 
 /// One open-loop load session against a freshly spawned server.
 pub fn run_session(cfg: &ServiceCfg, port: u16) -> Result<SessionResult> {
+    ensure!(
+        cfg.rate.is_finite() && cfg.rate > 0.0,
+        "arrival rate must be finite and positive (got {})",
+        cfg.rate
+    );
+    ensure!(
+        cfg.count > 0 && cfg.workers > 0,
+        "count and workers must be > 0"
+    );
     let mut child = spawn_server(cfg, port)?;
     // Warm up closed-loop (untimed) so the first timed request doesn't eat
     // page faults / cold caches.