fix(analyze): censor a clean run at the steps it ran, and refuse mismatched budgets

A run stops at whichever comes first, the step budget or --duration, so
a clean run that reached the wall clock exited with fewer steps than the
budget and was still credited with the whole of it. The model arm pays a
network call and a screenshot per step, so it reaches the wall sooner and
was handed exposure it never had.

Nothing checked that two arms shared a budget either. Thirty identical
clean runs under budgets of 400 and 100 read a12 0.000 and p 1.685e-14
from the rank-sum while the log-rank in the same report read p 1.0000.
groupArms already refused this within one arm.

The claims the old convention left in comments and report lines are
corrected rather than left standing beside the new behaviour.

cmd/internal-tools/analyze/paired.go

@@ -174,7 +174,7 @@ type pairedComparison struct {
 }
 
 // pairArms matches the two arms by seed and contrasts them pair by pair.
-// Censored runs enter at the step budget, the same convention the unpaired
+// Censored runs enter at the steps they ran, the same convention the unpaired
 // comparison uses. A seed usable in one arm and not the other is named rather
 // than dropped silently, because that is a host that lost a run and it is what
 // the campaign manifest exists to make visible.