fix: address M2.5 verifier findings before merge

AIMD ceiling now respects per-source max_concurrency and the pacer is
assembled explicitly in the client; MIN_CALLS parses as strict int;
acceptance doc corrects source-5 attempt count to 549; design and
migration notes aligned with implemented 429/stall/suppression
semantics and AIMD constants documented.

.env.example

@@ -42,6 +42,8 @@ LLM_CIRCUIT_BREAKER_COOLDOWN=60          # 或 LLM__BREAKER__COOLDOWN_S
 # LLM__BREAKER__FAIL_RATE=0.6            # 窗口失败率阈值(429 不计入)
 # LLM__BREAKER__WINDOW_S=60              # 失败率窗口(双 30s 桶)
 # LLM__BREAKER__MAX_COOLDOWN_S=300       # 开路指数退避封顶(缺省 max(300, cooldown))
+# ── AIMD 自适应并发(M2.5,库常量非 env 键): 每源初始 8,429 ×0.5,成功 +1/limit,
+# ── ceiling = max(64, 源级 MAX_CONCURRENCY);禁用需构造函数注入自定义 pacer ──
 # LLM__QUOTA_FULL=wait                   # wait(默认) | fail_fast
 
 # ══ 装配选择(PGW_*)══