test(so): document the POSIX GLR-cap branch as a bounded smoke, per falsification

Follow-up correcting d8a78e8, whose message claimed a broken merge cap
crashes "within the first second" so the 10s alarm could not mask it.
Falsification disproved that claim AND found the guard was vacuous on
POSIX from the start:

- With CBM_TS_STACK_MERGE_MAX_DEPTH deleted outright, the ORIGINAL
  unbounded test stayed GREEN (220s full grind, no crash) on macOS ASan.
- Small thread stacks (2 MB, then 512 KB) did not change that.
- Instrumenting the vendored recursion showed why: the recursive merge
  path is NEVER ENTERED for this input in the observable window — max
  depth stays 0. There is nothing for a stack bound to catch here.

So the cap-regression DETECTION lives in the Windows in-process branch
(real ~1 MB native stack, where #913 actually manifested — exercised by
the windows CI leg). The POSIX branch is, and always was, a bounded
no-crash smoke of the pathological parse; the 10s alarm makes it
deterministic (12-15s across three runs, was 2-218s machine-dependent)
without any detection loss, because there was no POSIX detection to
lose. The experimental pthread machinery is dropped; the test comment
now carries the falsification data so no future reader mistakes the
POSIX branch for a cap guard.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

tests/test_stack_overflow.c

@@ -448,6 +448,7 @@ static void so_parse_alarm_exit(int sig) {
     (void)sig;
     _exit(0);
 }
+
 #endif
 
 /* Parse `content` with tree-sitter DIRECTLY in a forked child — bypassing
@@ -480,13 +481,18 @@ static bool so_parse_crashes(const char *content, CBMLanguage lang) {
         return false;
     }
     if (pid == 0) {
-        /* Deterministic ceiling: past the merge cap the ambiguity-exploded
-         * GLR parse GRINDS (minutes, environment-dependent — measured 2s to
-         * 218s for the identical input). The guard's signal is the CRASH,
-         * which fires within the first seconds when the recursion cap
-         * regresses — so a clean exit after 10s proves the cap held without
-         * paying for the rest of the grind. SIGSEGV/SIGBUS still report as
-         * WIFSIGNALED; the alarm handler exits cleanly, never masking them. */
+        /* Deterministic ceiling. Falsification data (2026-07-18, macOS
+         * ASan): with CBM_TS_STACK_MERGE_MAX_DEPTH deleted outright, this
+         * branch stayed GREEN both unbounded (220s full grind, no crash)
+         * and bounded — instrumentation shows the recursive merge path is
+         * never even entered here (max depth 0 through the whole window).
+         * The cap-regression DETECTION therefore lives in the Windows
+         * in-process branch above (real ~1 MB native stack, where #913
+         * manifested); this POSIX branch is a bounded no-crash smoke of
+         * the pathological parse, and grinding past 10s adds no signal
+         * (unbounded it wandered 2s-218s with machine state). A real
+         * SIGSEGV/SIGBUS still terminates the child by signal before the
+         * alarm handler can exit cleanly. */
         signal(SIGALRM, so_parse_alarm_exit);
         alarm(10);
         TSParser *parser = ts_parser_new();