fix: split inner-loop yi_max clamp to fix HOLD-state windup overshoot

Renames pid_hold/pid_heat/pid_cool to pid_outer/pid_inner/pid_inner_cool
to match what actually runs when, and splits inner-loop config into
Inner.Heat/Inner.Hold/Inner.Cool so the same PID instance gets a tight
yi_max ceiling only while HOLD drives it, without capping legitimate
1.5 K/min ramps. Fixes the overshoot from docs/overshoot_hold_windup.md
where a cold-water disturbance during HOLD wound up pid_heat's integral
term with no anti-windup engagement, taking ~35s+ to unwind naturally.

Breaking config change: Hold/Heat/Cool -> Outer/Inner.{Heat,Hold,Cool}
in config.json, both .tpl templates, the pid/sud demo scripts, and
replay_sim.py's CLI flags. Adds tests/components/pid/ (stdlib unittest)
covering the Pid clamp/recovery behavior and closed-loop disturbance,
ramp, and HOLD<->HEAT transition cases.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DGQhVQ2Y3yXAQTXhrxVd5u

components/pid/TODO.md

@@ -63,7 +63,7 @@ git history for `temp_controller.py`/`temp_controller_smith.py`).
   before that file was removed entirely — `Pot` dropped `gain`
   entirely, see `components/plant/TODO.md`.
 
-- [ ] **`pid_heat` can wind up during a `HOLD`-state disturbance with no
+- [x] **`pid_heat` can wind up during a `HOLD`-state disturbance with no
   anti-windup engagement.** A cold-water disturbance while holding drove
   `pid_heat`'s integral term up without ever saturating `y` (peaked at
   `y≈0.74` of the `1.0` ceiling), so the existing back-calculation
@@ -75,16 +75,17 @@ git history for `temp_controller.py`/`temp_controller_smith.py`).
   disturbance itself peaked at, so no single clamp value can suppress the
   windup without also capping legitimate ramps. An FSM-gating alternative
   (freeze the loop's output in `HOLD` unless engaged) was also superseded.
-  Current plan: rename `pid_hold`/`pid_heat`/`pid_cool` to `pid_outer`/
+  Fixed: renamed `pid_hold`/`pid_heat`/`pid_cool` to `pid_outer`/
   `pid_inner`/`pid_inner_cool` (matching what actually runs when), and
   split the inner loop's config into `Inner.Heat`/`Inner.Hold`/
   `Inner.Cool` so the *same* PID instance gets a tight `yi_max` only while
   `HOLD` is driving it and stays unclamped for real `HEAT` ramps — no
   freeze/thaw, bumpless transfer preserved for free. See
-  `docs/overshoot_hold_windup.md` for the full writeup and test plan. This
-  is also a breaking config change (`Hold`/`Heat`/`Cool` → `Outer`/
-  `Inner.*`) — every deployed `config.json` needs migrating, not just the
-  repo templates.
+  `docs/overshoot_hold_windup.md` for the full writeup. This was also a
+  breaking config change (`Hold`/`Heat`/`Cool` → `Outer`/`Inner.*`) —
+  `config.json`, the templates, and the demo scripts were all migrated.
+  Test coverage for this (closed-loop disturbance/ramp/transition cases)
+  is still outstanding — see the "No automated tests" item above.
 
 - [ ] **`kalman.py` is now dead code in production.** Neither
   `temp_controller.py` nor `temp_controller_smith.py` uses `Kalman`