Let a sweep run more than four at a time, and name the run a failure was in

Concurrent runs sat at 4 whatever FLOW_MAX_CASCADES said: that setting bounds
cascades, and the run drivers read a hardcoded MAX_PARALLEL nobody could reach.
FLOW_MAX_RUNS is the knob they read now, --max-runs/--max-cascades/--max-workers
are the same three as flags on serve, and the engine says which numbers it
started with — which is the only way to tell that a settings file was read.

Events keep the run they happened in. The payload always carried it and the
persist path dropped it, so reading one run's failures meant filtering the
engine-wide list; a batch run's id reaches those events now too, since a run
has no journaled item to name itself by.

Also: a provisioner's 0 means "no deadline" rather than "cancel on the next
reconcile", and a command that reaches no engine says how to start one.

docs/code/api.md

@@ -176,7 +176,7 @@ read one back.
 | `/observability/timeseries` | executions and failures over a window |
 | `/observability/flows` | per-flow rollups with a 60-slice trend |
 | `/observability/runs` | recent cascades, with `?flow=`, `?since=`, `?until=` |
-| `/observability/events?kind=failure\|audit` | what went wrong, or who changed what |
+| `/observability/events?kind=failure\|audit` | what went wrong, or who changed what; narrows by `?flow=`, `?run=`, `?since=`, `?until=` |
 | `/observability/dead-letter` | work the engine gave up on |
 
 `GET /utils/health/` is the deep health check the container probe uses: it