feat!: name the unknown key, expose tail probabilities, flag short fits

Three issues from two downstream consumers, all small, all sharing a
theme: the crate had the information and would not hand it over.

#44 — `UnknownKey { team: 0, member: 0 }` did not say which key. A
consumer upgrading 0.1.2 -> 0.4.1 had every one of 5591 predictions
return this error, fell back to a neutral 0.5, and lost its entire
metadata model for a day. Nothing crashed and nothing logged; it was
found by sweeping an unrelated parameter and noticing the output did not
move. The 0.4.0 change that made unknown keys an error was right — the
error was just too anonymous to act on. It now carries the key's `Debug`
rendering, and its `Display` says what to do about it. The precondition
is documented on every prediction entry point, which the reporter said
would alone have saved the day.

#43 — `cdf` was `pub(crate)`, so a consumer asking "is this competitor
below the cutoff" approximated it with a `mu + z * sigma` band and had no
way to say what confidence any `z` bought. Adds
`Gaussian::probability_below` / `probability_above`. The second is
separate on purpose: `1 - cdf` collapses to exactly zero past ~8.3
sigma, and a stopping rule is evaluated precisely there. Both route
through the survival function added in 0.4.1, so this is visibility
rather than new numerics.

#50 — `ConvergenceReport` was not `#[must_use]`, so the one signal that
a fit stopped short was trivially discarded. It now is, and that
immediately found 78 sites doing exactly that — including this crate's
own ATP example, which was capped at 10 sweeps when the history needs
30. The example now reads the report and says so.

`ITERATIONS = 30` is documented as the floor it is, with the three
measurements to hand: 400 events over 100 competitors already stops
there at ~7e-3 against a 1e-6 tolerance, the ATP example needs 30 at a
much looser one, and a consumer's 2000-node model needs 76 to 161.

BREAKING CHANGE: `InferenceError::UnknownKey` gains a `key` field, and
the prediction methods now require `K: Debug` in order to fill it.

Closes #43, #50. Refs #44 — its third ask, an opt-in `UnknownKeys::Skip`
mode, is a live API question and deliberately not answered here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011hcFjNDmHXZF8URGLku5zZ

src/error.rs

@@ -50,7 +50,17 @@ pub enum InferenceError {
     ///
     /// Reported rather than skipped: dropping unknown keys turns a team of
     /// strangers into a confident-looking probability about nobody.
-    UnknownKey { team: usize, member: usize },
+    ///
+    /// `key` is the offending key's `Debug` rendering. It is carried because
+    /// the indices alone are not actionable: a caller that logs
+    /// `UnknownKey { team: 0, member: 0 }` learns nothing about *which* of its
+    /// keys the history has not seen, and the natural handling — fall back to a
+    /// neutral value — turns the whole thing into a plausible constant.
+    UnknownKey {
+        team: usize,
+        member: usize,
+        key: String,
+    },
     /// A prediction was given a team with no members.
     EmptyTeam { team: usize },
     /// Fewer than two teams were supplied to a prediction.
@@ -108,10 +118,12 @@ impl fmt::Display for InferenceError {
                     "competitor {competitor}: this batch sets {field} to two different values"
                 )
             }
-            Self::UnknownKey { team, member } => {
+            Self::UnknownKey { team, member, key } => {
                 write!(
                     f,
-                    "team {team}, member {member}: no skill recorded for this key"
+                    "team {team}, member {member}: no skill recorded for key {key} \
+                     (every key must already be known to the history; pre-filter \
+                     with `lookup` or `current_skill` if that is not guaranteed)"
                 )
             }
             Self::EmptyTeam { team } => {