sea_surface_estimator: warn when chart_datum present but MHHW frame missing

[rolker]

Context

Follow-up surfaced during the pre-push review of #25 (datum resolution chain).

sea_surface_estimator's is_out_of_range() looks up both the chart_datum
and mhhw frames inside one try/catch and returns "don't filter" if either
lookup throws:

mllw_tf = tf_buffer_->lookupTransform(frame_id, chart_datum_frame_, ...);
mhhw_tf = tf_buffer_->lookupTransform(frame_id, mhhw_frame_, ...);
// catch → return false  ("don't filter")

After #25, a polygon/param datum can supply chart_datum without mhhw
(an entry that sets chart_datum_z but omits mhhw_z, or a lake_datum
without lake_datum_mhhw). In that case chart_datum is published and trusted
by s57_layer, but the MHHW lookup throws, so the tide-plausibility bound
silently disables itself — the safety check turns off while the datum-consuming
correction stays on. This is documented as an acceptable degradation in
mru_transform's README, but it's invisible at runtime.

Proposal

Distinguish "no datum at all" from "MLLW present, MHHW missing":

• Look the two frames up separately.
• When chart_datum resolves but mhhw does not, emit a throttled WARN
  ("tide plausibility bound disabled: MHHW frame unavailable") so operators
  know the sanity check is off, rather than silently accepting all estimates.

Acceptance

• is_out_of_range (or its caller) logs a throttled warning when chart_datum
  is available but mhhw is not
• Behavior unchanged when both frames are absent (still "don't filter", no spam)

Part of #25.

---

Authored-By: Claude Code Agent
Model: Claude Opus 4.8 (1M context)