A crash between the probe rounds now loses the completed round capture, and nothing says so

[bug3]

Raised by melchior-1 as F5 on consult 0003-review-scratch, adopted, deferred
here by the user's decision while reviewing #4.

What happens

Before #4 each round's capture was written as soon as the round finished, so a
process killed between the rounds still left the isolated round's raw stream on
disk. The captures are now held until both rounds are over, which is what stops
the first round's record from reaching the second round's seats, and a kill
between them loses it.

This was a deliberate trade and it is written down nowhere. The sidecar, not
the captures, is what a crash has to leave behind, and quota was already spent
on the round whose record is lost.

What would settle it

Either write the trade into docs/protocol.md beside the crash-safety
paragraph, which makes it a decision rather than an accident, or write each
capture immediately into a per-run directory outside the repository the seats
are pointed at and move it into workDir after restore, which keeps both the
crash evidence and the hygiene property.

The second is the better answer if the captures are worth a crash. It is more
machinery than the trade is obviously worth, which is why this is a question
and not a patch.