feat(time-model): pin shift=4,sleep=off and carry the replay-flush QEMU patch

[darwin67]

Implements the pin the owner approved, so RFD 4 Phase 0's last two items are done and the product launches the pinned model.

What changed

• flake.nix applies poc/time-model/qemu-nosleep-replay-flush.patch to the pinned emulator — one way to build it, with the spike expression removed — restricted to the x86-64 system target with documentation off, plus a devShells.light without QEMU for the jobs that never run it.
• crates/simferret/src/vm.rs pins TIME_MODEL = "shift=4,sleep=off", with the doc comment rewritten to say why the patch is carried and that it is intended to be dropped when upstream includes it; the argument-vector assertion now asserts the pinned options.
• poc/time-model/reference-host-values.txt records the patched emulator's digest and the re-measured values.
• The CI host-input assertion expects delivered, which keeps the patch load-bearing, and the regression cases follow.
• rfd/0004/EVIDENCE.adoc records the pin, its verification, and its cost; rfd/0004/README.adoc records the carried patch and the drop intent; rfd/0004/IMPLEMENTATION.org has Phase 0 at DONE with the last two items checked; docs/time-model.adoc follows.

Verification (reference host, patched emulator)

• The pinned model re-measured against the patched build: 5/5 runs completed, verdict reproducible, and every measurement equal to the record — the patch does not move the guest's measurements.
• scripts/time-model-gate.sh passes with the patched digest in the reference record.
• scripts/time-model-input-probe.sh --expect delivered reports input=delivered with stopped_by_probe=true.
• record_and_replay_launch_the_configured_time_model passes.
• scripts/phase4-acceptance.sh records a run under the pinned model and replays it twice with matching normalized events, assertions, and semantic outcome digest.
• make check-rfds passes; the remaining suites run in this PR's CI.

CI cost

• Before: the unrestricted patched build, 16 minutes end to end on the reference host (configure 3m16s, build 11m28s, fixup 1m02s), paid by every Linux job that instantiates the dev shell.
• After: restricted to x86_64-softmmu with docs off (under about eight minutes here), and paid by one job — qemu-replay — because the format, lint, and test jobs use devShells.light.

Next

The upstream report (the patch plus the input probe as a regression test) is a separate docs PR; it will not be submitted upstream from here.

Review fixes

The evidence now separates the historical stock and unrestricted-spike results
from the pinned build (its digest, and the replay-log growth the patch causes:
3,386,955 bytes against 330,255), docs/time-model.adoc and the gate and probe
comments describe the pinned state rather than the blocker, the checklist's
recorded-identity half is attributed to Phase 1, and the harness comments say
what the synthetic non-delivery case is for.

Follow-up review fixes

The replay-log growth is recorded as an observation rather than an explained one;
the historical table's commands are marked as needing the stock emulator; the
decision paragraph reads as history the owner has since taken; the remaining
current-state sentences about the patch and the CI assertion are updated; the
index links flake.nix rather than the deleted spike expression; the harness
comment is expectation-only; and the completed checklist item names what it
actually asserts, with the recorded-identity comparison left to Phase 1.