labsim: both matrices green end to end, numbers reproduced

Final confirming run with GRACE=300 and every fix installed:

  --all   ALL PASS  (T0 T3 T5 T8 T11 T12)
  --hard  ALL PASS  (replace / deny / disable, each policy verified)

Second independent measurement of the hard failover, which is what makes the
figures trustworthy rather than anecdotal:

                run 1   run 2
  replace        26s     26s
  deny          148s    141s
  disable        21s     20s

`deny` sits at ~141-148s across both, so it is the AC's dead-peer behaviour
and not a one-off; GRACE=300 keeps roughly 2x margin.

Corrected an overclaim in PPPOE-HA.md while confirming it: the invariant row
read "AC never showed two simdsl sessions", and under session-control=disable
it did -- one live, one orphaned from the destroyed router. Only ever one LIVE
router dialled, which is the invariant that matters. Said so plainly rather
than leaving a table that reads better than the evidence.

labsim/wan-failover-evidence/README.md

@@ -10,11 +10,13 @@ router simply ceases — and times how long until the survivor holds a PPPoE
 session. Run across every policy VyOS can express, because Vodafone's is
 unknown:
 
+Two independent runs, so these describe the AC's behaviour rather than one-offs:
+
 | `session-control` | takeover | |
 |---|---|---|
-| `replace` | 26s | accel-ppp default; the new auth kills the old session |
-| **`deny`** | **148s** | the AC refuses the survivor until its own dead-peer timer frees the dead session |
-| `disable` | 21s | no single-session enforcement at all |
+| `replace` | 26s / 26s | accel-ppp default; the new auth kills the old session |
+| **`deny`** | **148s / 141s** | the AC refuses the survivor until its own dead-peer timer frees the dead session |
+| `disable` | 21s / 20s | no single-session enforcement at all |
 
 `deny` is the only one that matters for sizing, and `GRACE=300` in
 `migration/vrrp-wan.conf` comes from it. Session polling during that run caught