fix(analyze): censor a clean run at the steps it ran, and refuse mismatched budgets

A run stops at whichever comes first, the step budget or --duration, so
a clean run that reached the wall clock exited with fewer steps than the
budget and was still credited with the whole of it. The model arm pays a
network call and a screenshot per step, so it reaches the wall sooner and
was handed exposure it never had.

Nothing checked that two arms shared a budget either. Thirty identical
clean runs under budgets of 400 and 100 read a12 0.000 and p 1.685e-14
from the rank-sum while the log-rank in the same report read p 1.0000.
groupArms already refused this within one arm.

The claims the old convention left in comments and report lines are
corrected rather than left standing beside the new behaviour.

cmd/internal-tools/analyze/survival.go

@@ -7,8 +7,7 @@ import (
 
 // observation is one run reduced to what the survival analysis needs: the step
 // count at which it left the risk set, and whether it left because a violation
-// was found (an event) or because it exhausted the step budget without one
-// (right-censored). A run that failed or timed out is neither and never
+// was found (an event) or because the run ended without one (right-censored). A run that failed or timed out is neither and never
 // reaches this type.
 type observation struct {
 	Steps float64