Bound version-stats default reads

The Sources page (/dashboard/records) loads in roughly seven seconds on the live corpus because it blocks on GET /ref/records/version-stats?limit=8. That route still runs an unbounded recordchanges aggregate whenever the retained-size global projection is dirty. On the live Postgres corpus this means sorting and grouping more than three million record_changes rows on each page load.

The earlier projection-backed version-stats design optimized the clean case but kept two exactness fallbacks: dirty stream rows were always verified against ground truth, and a dirty global projection forced the full record_changes scan. That preserved advisory exactness, but it left the owner dashboard exposed to the worst case on any rebuilding or dirty projection.

The owner-only GET /ref/records/version-stats read SHALL produce its bounded top-churn diagnostic for an unfiltered request without running an unbounded aggregate over the entire recordchanges table. The reference implementation SHALL source the unfiltered advisory from the maintained retained-size projection and SHALL compute the ground-truth aggregate (COUNT(*), COUNT(DISTINCT recordkey), MAX(emittedat)) only for a bounded candidate set of clean projection rows whose facts could classify above normal.