labsim: both matrices green end to end, numbers reproduced

Final confirming run with GRACE=300 and every fix installed:

  --all   ALL PASS  (T0 T3 T5 T8 T11 T12)
  --hard  ALL PASS  (replace / deny / disable, each policy verified)

Second independent measurement of the hard failover, which is what makes the
figures trustworthy rather than anecdotal:

                run 1   run 2
  replace        26s     26s
  deny          148s    141s
  disable        21s     20s

`deny` sits at ~141-148s across both, so it is the AC's dead-peer behaviour
and not a one-off; GRACE=300 keeps roughly 2x margin.

Corrected an overclaim in PPPOE-HA.md while confirming it: the invariant row
read "AC never showed two simdsl sessions", and under session-control=disable
it did -- one live, one orphaned from the destroyed router. Only ever one LIVE
router dialled, which is the invariant that matters. Said so plainly rather
than leaving a table that reads better than the evidence.

migration/vrrp-wan.conf

@@ -23,11 +23,12 @@ WAN_VIF=53
 # exists to prevent.
 #
 # MEASURED, labsim T4, master destroyed with `virsh destroy`, time until the
-# survivor held a PPPoE session (labsim/wan-failover-evidence/T4-*):
+# survivor held a PPPoE session (labsim/wan-failover-evidence/T4-*). Two
+# independent runs, so these are the AC's behaviour rather than one-offs:
 #
-#     session-control=replace    26s
-#     session-control=deny      148s   <-- worst
-#     session-control=disable    21s
+#     session-control=replace    26s / 26s
+#     session-control=deny      148s / 141s   <-- worst
+#     session-control=disable    21s / 20s
 #
 # `deny` is the hostile case and the only one that matters for sizing: the AC
 # refuses the survivor until its own dead-peer timer frees the dead session.