chore: make the runner and backend docs match the code, and reject bot configs that panic

[oglassdev]

A static audit of the repo turned up a handful of places where the docs describe behaviour the code no longer has, one leftover compatibility input, and bot settings that are accepted and then panic. This fixes the ones that still hold on current main.

Docs that disagreed with the code

• chunk-jvm README: the JVM also gets -Xms and --enable-native-access, runs the serial collector on one CPU, and records an AOT cache from 448 MiB on one CPU rather than 768 MiB.
• chunk-backend README: schema changes were described as additive only, with field and index changes rejected. They are accepted when the deployment's migration journal carries a migration for them.
• chunk-store: the Operation comment said the fingerprint hashes the deployment and contract. It hashes the function, caller and arguments, so a result survives redeployment.
• chunk-management: fork_environment said it deploys the source's active release. A fork starts without a deployment and gets the release its restored data was serving.

Behaviour

• CHUNK_SERVICES no longer accepts exec. It was ignored with a warning; it is now an unknown service like any other.
• chunk-bots rejects settings that previously passed validation and panicked later: --first/--bots combinations that overflow a u32, intervals and timeouts that are not finite or exceed a day, login rates below 0.001, and thread or pending counts of zero or beyond what Tokio accepts.

Checks

cargo fmt --check and cargo clippy --all-targets -D warnings on the touched crates, the chunk-environment services test, and each rejected bot setting by hand. Three review rounds, the last clean.

🤖 Generated with Claude Code