fix(code-runtime-python): correct the log-budget floor to 64 and record the marker envelope bound

The review found the 62 floor off by two (the marker's fixed prefix is 51
characters counting both square brackets, so marker(62) serializes to 63) and
the constructor error over-claiming a bound the marker-as-envelope design does
not deliver. Fixes:
- MIN_LOG_BYTES is 64 (marker-only serialization fits with one byte of room);
  the JSDoc arithmetic counts the brackets; the rejection test pins 63; the
  forged-frame test uses 11 NULs (69 escaped) at 64.
- The constructor error now states the marker-only guarantee, and the README
  Known Limitations (en + zh) records the real bound: a truncated run with
  admitted entries serializes its logs to maxLogBytes + marker + envelope.
- The SIGXCPU-mask tests burn with time.process_time() instead of wall-clock
  perf_counter, so a contended CI runner cannot under-burn the budget.
- The settlement note (en + zh) records the 64 floor and the marker envelope
  bound, including the zh pre-encode section that the earlier pass missed.
- The README constructor-rejection list names the maxLogBytes floor.
Pairings re-recorded; corpus-wide verify-translation-pairing passes 1004.

packages/code-runtime/code-runtime-python/src/index.ts

@@ -227,18 +227,22 @@ const MAX_PENDING_CHUNKS = 1024
 const FRAME_ENVELOPE_BYTES = 64
 
 /**
- * Smallest `maxLogBytes` the backend can honor. The log ledger's truncation
- * marker (`logTruncationMarker`) plus the serialized outer-array envelope must
- * fit the budget, or a truncated run returns more than the configured cap: the
- * marker text is `[dsh-code-runtime-python] log capture truncated at <N>
- * bytes` — 49 fixed characters plus the digits of N plus 6 — serialized with
- * quotes and brackets adds 4, so the smallest N that admits its own marker is
- * 61 (49 + 2 + 6 + 4); 62 is the floor with one byte of room. `maxValueBytes`
- * has no floor beyond the positive-integer requirement: a completion can be as
- * small as a single byte (`1`), and the done-frame envelope is seam protocol
- * cost, not the advertised completion budget.
+ * Smallest `maxLogBytes` the backend can honor. The truncation marker alone
+ * (`logTruncationMarker`) must serialize within the budget, or a marker-only
+ * truncated run returns more than the configured cap: the marker text is
+ * `[dsh-code-runtime-python] log capture truncated at <N> bytes` — 51 fixed
+ * characters (the bracketed prefix `[dsh-code-runtime-python] log capture
+ * truncated at ` counts both square brackets) plus the digits of N plus 6 —
+ * and its serialized form adds 4 (two quotes, two array brackets), so the
+ * smallest N that admits its own marker is 63 (51 + 2 + 6 + 4 = 63); 64 is the
+ * floor with one byte of room. The marker itself remains envelope, not
+ * payload, so a truncated run with admitted entries serializes to at most
+ * `maxLogBytes + marker + envelope`; that bound is recorded in the README.
+ * `maxValueBytes` has no floor beyond the positive-integer requirement: a
+ * completion can be as small as a single byte (`1`), and the done-frame
+ * envelope is seam protocol cost, not the advertised completion budget.
  */
-const MIN_LOG_BYTES = 62
+const MIN_LOG_BYTES = 64
 
 /**
  * Extra time added to `graceMs` before the post-kill close-deadline force-settles
@@ -781,11 +785,14 @@ export class PythonCodeRuntime extends CodeRuntime {
       if (this.config[key] > limit) {
         throw new Error(`dsh-code-runtime-python: config.${key} must not exceed ${limit} (a payload that large cannot cross the ${FRAME_CEILING_BYTES}-byte fd-3 frame ceiling, so the run would fail as worker-exit rather than output-limit), got ${String(this.config[key])}`)
       }
-      // Reject a log budget too small to honor: the ledger must fit its
-      // truncation marker plus the serialized outer-array envelope, or a
-      // truncated run returns more than the configured cap.
+      // Reject a log budget too small to honor: the truncation marker alone
+      // must serialize within the budget, or a marker-only truncated run
+      // returns more than the configured cap. (With admitted entries the
+      // marker is envelope, so the serialized logs run to
+      // `maxLogBytes + marker + envelope`; that bound is recorded in the
+      // README's Known Limitations.)
       if (key === 'maxLogBytes' && this.config[key] < MIN_LOG_BYTES) {
-        throw new Error(`dsh-code-runtime-python: config.maxLogBytes must be at least ${MIN_LOG_BYTES} (a smaller budget cannot serialize the truncation marker plus the outer-array envelope, so the run would return more than the configured cap), got ${String(this.config[key])}`)
+        throw new Error(`dsh-code-runtime-python: config.maxLogBytes must be at least ${MIN_LOG_BYTES} (a smaller budget cannot serialize the truncation marker itself, so a marker-only truncated run would return more than the configured cap), got ${String(this.config[key])}`)
       }
     }
     // The child builds, charges, and frames a `maxLogBytes` log entry or a