Docs: FR-U48 bundles two rules, so Appendix E's group-U all-nine-P default overclaims

[dichovsky]

Carried over from the review of #49 (merged). Ten of the eleven requirements added there state exactly one rule; FR-U48 does not.

docs/design/srs.md:992-994 reads:

FR-U48 — Best-effort marker retirement. A resume shall not depend on retiring the session's clean-stop marker: removal is attempted only after the relaunched session releases the foreground, is skipped when that attachment ends in failure, and a removal that fails leaves the resume successful.

The first two clauses are separate observable rules — an ordering constraint and a skip-on-attach-failure constraint — and neither is entailed by the leading "shall not depend". Both are stated in the indicative, against the document's own rule at docs/design/srs.md:39 that "Every requirement uses shall as the single word that marks a mandatory rule (§5.2.4)" and "Each requirement states exactly one rule (§5.2.5 Singular)".

Because the Appendix E section-default row (docs/design/srs.md:1438) claims all nine §5.2.5 characteristics pass for FR-U01–FR-U49, it currently asserts a Singular grade FR-U48 does not earn. This is structurally identical to FR-D23, whose override row already reads S = NE with the note "Bundles deduplication + omit-the-actor + skip-archived; could split into three."

Impact: the grading matrix is the document's own honesty mechanism — a section default that silently covers a bundled requirement is exactly the drift the override rows exist to prevent. One id's worth, but it is the kind of inaccuracy that compounds as the group grows.

Acceptance: either split FR-U48 into its timing rule and its tolerance rule, each with a shall, or keep it as one id and add an Appendix E override row (S = NE) plus a matching entry in the "Flagged requirements" list at docs/design/srs.md:1430-1439, following the FR-D23 precedent. Docs-only; no behavior change.

Two LOW findings from the same review are worth folding into whichever pass takes this on, since they touch adjacent lines:

• docs/design/srs.md:942 — FR-U39's "record-producing" qualifier is vacuous. src/launcher/stop.ts:217-222 writes the clean-stop marker unconditionally, before renderTeamStopResult. The qualifier is borrowed from FR-U29/FR-U49 where it correctly scopes record emission; on a filesystem side effect it reads as "no record, no marker".
• docs/design/srs.md:993 — "only after the relaunched session releases the foreground" presumes an attach. With relay.attach false in .crew/launcher.yaml there is no foreground and runLiveLaunch returns straight into retireResumeMarker. "after runLiveLaunch returns successfully" covers both paths. Note this clause also interacts with Console: team resume attaches tmux inside the headless crew ui process, violating FR-U20 #50: fixing that would make the wording stale for the Console path.