Embedding WASM cap reprobe

Trap: lowering a cap in the existing worker looks sufficient, but WASM memory never shrinks; remembering the highest failed cap or letting stale sibling providers overwrite persistence can also re-admit a proven-bad size. Fix: respawn with a fresh heap for every downward change, retain the lowest positive failed cap as a shared atomic hard ceiling (knownBad - 1), and clamp after all upward logic. Backoff and non-finite inputs must stay within [MIN_EMBED_TOKENS, MODEL_MAX_TOKENS]; upward probes may reuse a worker but never reach the WASM ceiling or known-bad cap. Compare persisted and startup memory in consistent total/per-worker units, storing the divisor when needed.