fix(capture): enforce network scan merge bounds
Summary
Enforce the network-entry limit before retaining the primary seed and before appending secondary entries. Oversized primary scans no longer escape the merge cap. Preserve the existing source-window reconciliation rules.
Two files changed: the merge owner and behavioral regressions. Closes #4378; part of #4368. No scope expansion.
Validation
Head 95352b2058594fee78f2f540d14c0cb5786a9585; base 5a836c05d5abfe3daa7556af4a1906a1e1029e17.
Frozen install/build, formatting and all eight runnable exact-head affected checks passed (exactCommit: true, checkoutChanged: false), including the full unit fallback. Receipt, skip ownership and regression proof: base 1 failed/22 passed → head 23 passed. Removing only seed trimming causes the retained merge case to fail; restoration returns 23 passes.
The coordinator reviewed the worker diff and corrected the seed-bound fixture; no separate model review of the entire final SHA is claimed. No live-device run is required for this deterministic scan merge. CI-owned/manual coverage remains an obligation; skipped tests are documented. No test or gate budget was relaxed.
Android smoke is currently failed at the tested head (Back → snapshot-diff assertion). Diagnosis and next comparison. Cause is unproven; no infrastructure retry or test weakening. Draft pending the live-check blocker.