Pool task_review_attempts and browser_iters into the quality friction denominator

[aaddrick]

Context

Follow-up from #165 / #176 (quality friction ratio denominator fix).

task_review_attempts and browser_iters are multi-scope run-wide aggregates of the same shape as the six stage drivers that now carry a scopes field (one per task / one per browser round), but this change deliberately left them out of scope. Their scopes is emitted as null rather than 1 specifically because pooling them was not done here — null honestly claims "not yet counted" rather than falsely claiming "single-scope".

Known defects this leaves invisible in workflows/ticketmill.js:

• task_review_attempts++ inside for attempt inside the per-task loop (observed 9 against a cap of 3)
• browser_iters++, incremented via runBrowserCheck called at both call sites (observed 6 against a cap of 3)

Both compare a run-wide aggregate against a per-loop cap, the same category of bug #165 fixed for the six other stage drivers.

Ask

Apply the same scopes-pooling treatment used for the six stage drivers in #165 to task_review_attempts and browser_iters, so their friction contribution is computed against cap * scopes rather than a bare per-loop cap.

References

• PR fix(observability): pool the quality friction denominator by scope count #176 (implements Fix the quality friction ratio's denominator #165)
• docs/architecture/gate-hygiene.md — the invariant section this would extend
• workflows/ticketmill.js:4683 (task_review_attempts++), :3293 (browser_iters++, called at :4762 and :4961)