crm: SelfJournal::recordFailure is called by no crm model, while the rung's own prose says rejected attempts must not vanish

[Yaraslaut]

Found by the N ladder lane while completing morph#412's journaling clause, and
reported rather than fixed inside a coverage ticket.

What is wrong

crm::SelfJournal::recordFailure is called by no crm model. lims uses the
same seam at six sites in sample_model.cpp; crm uses it at none.

That matters because crm's own prose says it must. self_journal.hpp's file
comment states that crm's field-level audit history "needs to show a rejected
attempt … rather than vanishing", and the rung README's build order §6 is cited
for it.

So exactly one of two things is true, and the repository currently asserts both:

• crm's audit trail silently omits rejected attempts, contrary to a stated
  obligation — in which case this is a user-visible defect in an audit feature,
  the same shape as the lims defect codecov.yml records ("a sample's audit
  trail silently omitted the second pair of eyes"); or
• the obligation is stale prose that survived a design change, in which case
  self_journal.hpp's comment and the README's §6 are wrong and should say so.

Deciding which is the work. It is not a coverage gap: adding a test would pin
whichever answer is already true rather than settle it.

The one place it is already answered, partially

examples/crm/tests/test_convert_lead.cpp:416 records that the absence is by
design for LeadModel. That covers one model. It says nothing about
AccountModel, OpportunityModel, QuoteModel, ContactModel,
CustomFieldModel or SavedViewModel, and it is a test comment rather than a
statement in the rung's own documentation.

Why it surfaced now

morph#412 asked whether two crm models' journaling paths were executed by any
test. They were not, and adding the tests found no defect on either path —
both models journal both mutations correctly, under the attached key, with the
caller's principal. The recordFailure gap is the residue: the success paths
are journaled and now tested; the rejection paths are not journaled at all.

Verification status: reproduced

grep -rn "recordFailure" examples/crm/ returns the definition and no crm model
call site; the same grep over examples/lims/ returns six call sites in
sample_model.cpp. Read on lane/n-ladder at 29a596b5, whose base is
origin/master be478df1.

Not verified: whether any crm action's rejection path should be journaled
under the rung's current design, as opposed to only the field-level history the
comment names. That is the decision this ticket exists to force, and it belongs
to whoever owns the rung's audit contract.

What would close this

1. A statement, in examples/crm/'s own documentation rather than in a test
   comment, of which crm actions journal a rejected attempt and which do not.
2. If the answer is "they should": recordFailure is called on those paths, and
   a test asserts the rejected attempt appears in the audit trail — failing
   without the call, in the manner morph#412's cases do.
3. If the answer is "they should not": self_journal.hpp's file comment and the
   README's build order §6 stop claiming otherwise, and
   test_convert_lead.cpp:416's by-design note is generalised from LeadModel
   to the models it actually covers.

Not closable by adding a call site without deciding the contract — that
picks the answer by accident.