docs: state what the save timeout and a racing delete actually guarantee (#51, #37)

The tracker comment said 'never a stalled job'; each transition can wait up to the timeout.
The delete refusal is judged at the moment of the attempt. Found by the PR #58 review.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/progress/tracker.go

@@ -57,8 +57,11 @@ func WithClock(now func() time.Time) Option { return func(t *Tracker) { t.now =
 func WithMinSave(d time.Duration) Option { return func(t *Tracker) { t.minSave = d } }
 
 // WithSaveTimeout bounds one save or heartbeat write. Progress is cosmetic, so a database
-// that stops answering costs a dropped write, never a stalled job: saves run under the
-// tracker's lock, which Begin and Advance (called by the engines) need (#51).
+// that stops answering costs a dropped write rather than an unbounded stall. It is still a
+// delay: saves run under the tracker's lock, which Begin and Advance (called by the engines)
+// need, so each transition can wait up to this long, and a hung database slows a job by
+// that much per call, out of the job's own time budget (#51). A dropped final save is not
+// retried; the row keeps its last saved step.
 func WithSaveTimeout(d time.Duration) Option { return func(t *Tracker) { t.saveTimeout = d } }
 
 // Tracker implements Reporter for one job.