context-monitor: confirm compacts from the jsonl compact_boundary, not from send-keys rc

PROBLEM: watchdog_compact returns True when send-keys succeeded. That means "typed into a pane", never "the agent compacted" - and v4.80/v4.82 WIDENED the gap, because a composer gate now sits in front of the send, so rc=True means "typed into a pane that LOOKED free". An actuator that has stopped working is currently indistinguishable from one that is working. SPEC from monitor-context-cc (tick.py author), adapted. Three states not two - sent-unconfirmed / confirmed / suspect-discarded - with sent-unconfirmed as the honest default and no silent promotion. Every failure mode fails toward UNCONFIRMED, because the costly error is a FALSE confirmation. LEZAMA DIVERGENCE, verified by monitor-context-cc on venus before agreeing: do NOT port their ctx-drop inference. tick.py infers a compact from a ctx sample dropping >=5 points, which forces two guards that exist ONLY because a ctx sample is a proxy - BACKFILL_GAP_S for the post-compact 0k statusline blackout, and SUSPECT_DIP_K=20 for a misread that dips then rebounds. context-monitor.sh already has last_compact_boundary_ts() at :1327, reading the compact_boundary marker CC itself writes into the transcript. That is GROUND TRUTH, not a signature. Confirmation = a boundary with ts > ctx_at_send; both guards then become deletable from the confirmation path rather than tunable. The reader is already proven in two call sites (watchdog_compact pre-send guard, send_compact decisive re-check after the ss idle-wait); only the post-send confirmation WRITE is missing. monitor-context-cc scanned 6 live venus transcripts: boundary present in 4, the 2 misses are young sessions that never compacted, so absence is correct there - no session compacted without a marker. CONSTRAINTS TO CARRY: - TAIL_BYTES=300000 bounds the read. Fine for confirmation (a boundary after ctx_at_send is near the tail by construction). NOT fine for "has this session ever compacted" or "how many times" - on a large transcript that reads as zero. Bound the claim to the window, same discipline as the ratios. Already documented at context-monitor.sh:1327-1331 for the ctx path. - BACKFILL_GAP_S still earns its place OUTSIDE confirmation: the 0k blackout breaks measurement and eligibility too, and that half does not go away. - NOT VERIFIED, carried forward unchanged from monitor-context-cc: there is no measurement of confirmation RATE across a population, only of the mechanism. Read it as "unconfirmed cannot be mistaken for confirmed", never as "confirmations work". RELATED LANE, do not duplicate: project CLEDGER is the venus-only closed-loop version of this same problem (Postgres ledger, outcome-verified). This item is the lezama context-monitor.sh half and should stay coordinated with it rather than reimplementing it. Behaviour change to the actuator, not a fix to something broken - deliberately NOT shipped the same night as v4.80-v4.83.