brokerd: runbook pointers for startup failures, no thread panics, args_os

M3a review findings 3, 5 (the cast), 6, 7 (brokerd), 11. A config, directory
or socket failure at start now ends with docs/runbook.md#brokerd-start-failed,
and losing a listener with #brokerd-listener-lost; both entries are new.
Threads start through thread::Builder, so a refused thread is reported
instead of silently killing a listener; an aborted connection no longer stops
the daemon. brokerd reads args_os and keeps the config path as a path. The
"requester went away" result is recorded at the time it happens.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

crates/brokerd/src/grants.rs

@@ -91,8 +91,7 @@ pub fn load(dir: &Path) -> Result<GrantSet, Vec<GrantProblem>> {
         match entry {
             Ok(entry) => names.push(entry.file_name().to_string_lossy().to_string()),
             Err(error) => {
-                // An entry that cannot be read is the same problem as the directory; keep going.
-                names.push(String::new());
+                // An entry that cannot be read is the same problem as the directory.
                 return Err(vec![GrantProblem {
                     file: dir.to_string_lossy().to_string(),
                     line: None,
@@ -198,7 +197,8 @@ fn span_line(text: &str, error: &toml::de::Error) -> u64 {
                 Some(before) => before,
                 None => text,
             };
-            before.bytes().filter(|&b| b == b'\n').count() as u64 + 1
+            let newlines = before.bytes().filter(|&b| b == b'\n').count();
+            u64::try_from(newlines).map_or(u64::MAX, |n| n.saturating_add(1))
         }
         None => 1,
     }