bench/limits-search.ts <url> runs the limits search per joint against the fake bus or a given arm server and prints a before/after table (lands once main is green) #513

Replaces #495, with the same scope. Pulls #500 and #505 were closed only because main's own test (src/stop-layout.test.ts, the notes pill) failed on every preview. The bench work in them passed its own tests (26 pass). Start from branch smith/495-bench-limits-search-ts-url-runs-the-limi and merge main after the fix lands.

Done when:

• [ ] Software/so101/bench/limits-search.ts with no argument runs on the fake bus, as bench/limits-sweep.ts does. With <url> it runs on that arm server, and --joint N runs one joint. It drives searchLimits from src/limits-search.ts and the sweep from bench/limits-sweep.ts, and reads and writes jointSpeedDegS / jointAccelDegS2 through PUT /settings.
• [ ] It starts at today's limits (90 °/s, 360 °/s²) and stays within RANGES in src/safety.ts. The gripper is skipped unless named.
• [ ] It refuses to start unless /status shows nobody driving, no STOP and no E-stop. If any of those appears mid-run, it stops at once and puts the starting limits back.
• [ ] It prints the command line it ran, then one markdown table: joint, limits before → after, and p95 error / overshoot / time to arrive before and after.
• [ ] bench/limits-search.test.ts runs it end to end on the fake bus: a table comes out, and the arm's settings end at the reported 'after' limits.
• [ ] Software/README.md has a short 'Faster limits' paragraph with the exact command, saying a person runs it at the arm while nobody drives.
• [ ] forge.json is untouched, and the whole bun --cwd Software/so101 test passes, so the preview deploys green.

Files: bench/limits-search.ts, bench/limits-search.test.ts, Software/README.md. Serves #439.