fix: honest witness --once exit; participate erasure ergonomics

[mellowcroc]

Fixes #10 and #11 (both found driving the scripts against real ceremonies on 2026-08-20).

#10 — witness watch --once false positive. A single check that found the phase open exited 0, differing from a real observation only in prose — so 07-role-witness-watch.sh (which runs under set -e and prints its summary after the command) reported "saw the Relay closure notification" when no closure existed. --once now exits non-zero with no closure observed: <phase> is still open; the script's success message is thereby gated by set -e with no script change needed. Runbook documents the exit contract.

#11 — participate ergonomics (all three parts):

1. DESTROYED prompt → stdout, so the tee'd participate log contains it and log-watching automation can respond (previously stderr-only: invisible in the transcript, we had to inject input via /proc/<pid>/fd/0).
2. Same-second erasure race removed without weakening the rule: destroyed_at is read against the candidate's attestation.json contributed_at and pushed to the next whole second when they'd collide (tiny-circuit contributions complete in <1 s, previously guaranteeing destroyed_at must be strictly after contributed_at unless the operator deliberately paused). proof-tool's strict-ordering validation is untouched; parse failures fall back to the old behavior. Unit-tested (normal case, same-second case, missing/corrupt metadata fallbacks).
3. Failed attempts archive instead of stranding: 04-role-participate.sh moves a failed attempt's outputs to RUN_ROOT/failed/<phase>-<participant>-<timestamp>/ on exit, so require_fresh_path passes on retry; nothing is deleted, the local candidate is preserved, and the operator is told exactly where it went.