Emit the [TRIAL-FUNNEL-RISK] line when the try-now funnel is heading for a 429 (an IP nearing the per-IP session cap) or when a trial cleanup cron has stopped succeeding (which is what lets sessions pile up against that cap).

Lives beside the platform-quota watcher for the same reason the AI-credential watcher does: same detector shape (approach-a-ceiling and absence-of-expected-outcome), same alert-token contract, same 20-hour dedupe, same dry_run-as-status. Different subject, so a separate route on a separate schedule.