Strict memory budget in a streaming writer: make failure sticky and test prefix recovery

For an append-only segmented file writer with a memory budget, a strict mode that only refuses the call that crosses the budget isn't enough: later calls (cut/flush/close) can still write, and close() has its own peak (building the index in memory) that a per-change check never sees. Make the failure sticky: set a failed flag with its message and have every entry point return it, account transients (the framed segment copy, the index body before building it) and encoder workspace by capacity, not size. Test both a mid-run crossing and a close-only crossing: after the failure, bytesWritten must not move and a crash-recovery reader must reopen the file to exactly the last published claim with an exact data prefix. Writing that test first showed both gaps (non-sticky refusal, unaccounted close peak) in an otherwise passing suite.