PPR operability: snapshot size guard, capture diagnostics, and the silent missing-KV no-op #651

Problems (all observability/limits, one surface)

1. Snapshot size: the capture data snapshot (feat(router): PPR capture data snapshot — shell/payload parity on a HIT #647) duplicates pinned ring data inside the shell entry. A page over a large cache() segment can push the entry toward store value limits (KV 25MB) with no signal.
2. Capture pipeline is a black box in production: stored / no-shell / refused / backed-off outcomes, snapshot bytes, write-barrier wait ms — none of it is observable except dev console warnings.
3. Silent fail-open on CF without KV: with no KV namespace configured, getShell/putShell no-op — every ppr route is a permanent MISS with zero diagnostics. Correctness-first v1 trade, but it needs to be loud.

Direction

• Size cap on the snapshot (configurable, sane default well under KV limits): over cap → skip the snapshot, store the shell without it (documented drift behavior), report once per key.
• A debug sink for the capture pipeline mirroring the CFCacheDebug pattern: outcome per attempt, snapshot bytes, barrier wait, backoff state. Wire into server-timing in dev.
• Once-per-isolate warning when a ppr route resolves to a store whose shell family is inert (CF-without-KV case), naming the fix (bind KV / use a shell-capable store).

Test plan

Unit: over-cap snapshot skipped + shell still stored + single report; missing-KV warning fires once. E2e: not needed beyond existing suites (behavior is diagnostics), but assert the size-cap fallback serves without hydration errors (documented drift is acceptable there).