durability: conformance scorecard + journaled LLM calls

[minglong51]

What

Two commits that convert ThreadLang's honest durability positioning into a public asset, then strengthen the reality behind it:

1. docs: score durability against the published seven criteria — new docs/durability-conformance.md scoring v0.13.3 against the Diagrid critique's definition of durable execution (the argument currently being levelled at LangGraph/CrewAI/Google ADK). 3 met, 2 partial, 2 out-of-scope-by-design; every verdict cites the module or doc section behind it. Linked from the README support boundary.

2. feat: journal LLM responses per run — run_durable wraps the LLM client in a per-run journaling layer (journal_llm=True default; ephemeral run_program untouched). Each call's request fingerprint + response lands in a new llm_journal table (additive _SCHEMA entry, no migration); a resumed run replays fingerprint-matched responses instead of re-calling the provider. This is the per-agent-turn checkpointing phase-2-durability.md explicitly deferred.

Claim, stated precisely

Across a hard crash, the interrupted step's completed model calls replay from the journal and at most the single in-flight call re-executes (down from "every call in the step"). Exactly-once remains impossible client-side and stays scoped out; tool calls in the interrupted step remain at-least-once. README, production.md, and the conformance doc were all tightened to this wording in lockstep.

Notes for review

• Keying is (run_id, request_fingerprint, occurrence) — no step_key column: the fingerprint is the step identity for distinct requests, and identical requests are semantically interchangeable. Documented in journal.py and the LLD.
• The wrapper preserves the runtime's getattr duck-typing: complete always, route/agent_step only when the wrapped client has them.
• emit llm rides the wrapped client and is journaled too.
• Zero runtime deps unchanged; no version bump.

Verification

250 tests pass (7 new: crash-mid-step replay counting provider calls, fingerprint-mismatch fallthrough, duck-typing preservation, AgentTurn round-trip, opt-out, route replay, terminal prune). ruff check, ruff format --check, mypy src/threadlang all clean; LLD+HLD updated in the same PR per the design-doc contract.