docs(design): ReorderBuffer spill-to-tempfile for stalled successors (#1884)

[oferchen]

Summary

• Documents the bounded-memory spill-to-tempfile plan requested by Ensure release workflow uploads architecture-specific assets #1884.
• Establishes that SpillableReorderBuffer<T> (crates/engine/src/concurrent_delta/spill.rs:218) and its ENOSPC / temp-dir-vanish hardening (PR Add branding checks to CLI version banners #2247, referenced in the prompt as docs(design): daemon async runtime choice - tokio vs async-std vs threaded (#1367, #1590) #4247) already cover the spill machinery, codec, hot-zone heuristic, and RAII cleanup.
• Calls out the missing wiring: consumer.rs:173-177 still constructs a bare ReorderBuffer, so the spill layer is dead code on the receiver's critical path; force_insert at consumer.rs:193 is the unbounded-growth fallback that a wired-in spill would retire.
• Recommends not enabling the spill on the default path without bench evidence. Proposes extending crates/engine/benches/reorderbuffer_memory.rs (PR bench(engine): ReorderBuffer memory occupancy at 100K/500K/1M (#1564) #4204) with an adversarial drift scenario, a DeltaResult payload, and spill-stats reporting, gated behind BENCH_REORDER_SPILL=1.
• Cross-references the stall metrics (PR feat(engine): expose ReorderBuffer stall-duration and queue-depth metrics (#1885) #4195), memory bench (bench(engine): ReorderBuffer memory occupancy at 100K/500K/1M (#1564) #4204), cache bench (bench(engine): profile ReorderBuffer cache behavior at 1M items (#1854) #4180), and wire-format audit (docs(audits): wire-format unchanged under parallel dispatch (#1548) #4205).

Test plan

• cargo fmt --all clean
• No em-dashes, no forbidden references in the new doc
• All cited file:line locations verified against the worktree state