Exact Bell-McCaffrey CL2 block as the default leverage adjustment (A18)

NEWS.md

@@ -50,6 +50,27 @@
   report CL2 leverage diagnostics: the returned covariance carries
   `max_leverage` and `n_capped_clusters` attributes, and a warning is emitted
   when one or more clusters hit the leverage cap.
+* CL2 now uses the exact Bell--McCaffrey leverage block by default when the
+  finite-sample correction is relevant and the dense-block calculation is
+  affordable (at most 100 clusters and cost proxy `G * max(D_g) * p^2 <=
+  5e9`, a measured sub-second marginal cost). At larger/prohibitive problems it uses the historical shortcut.
+  `cl2_adjustment = "exact"` or `"shortcut"` on `pffr()` and `coef.pffr()`
+  explicitly selects either variant. Exact-CL2 diagnostics include the number
+  of eigenvalue-floored blocks (`n_adjusted`).
+* The CL2 sandwich now checks the penalized hat matrix against its own bounds
+  (`0 <= h_ii <= 1`, `0 <= eigen(H_gg) <= 1`, and positive semi-definiteness of
+  the exact Bell--McCaffrey block) and **warns** when they are violated by more
+  than round-off. Such a violation means the model-based bread and the weighted
+  design have become numerically inconsistent -- a barely converged or
+  extremely ill-conditioned fit -- so the cluster-robust covariance is
+  meaningless however plausible it looks. Previously this produced silently
+  exploded standard errors (interval widths up to 1e133 were observed on
+  degenerate Poisson fits, with nothing to distinguish them from a legitimately
+  wide interval). The covariance is still returned, now carrying
+  `max_obs_leverage` and `hat_invariant_violation` attributes. The CR1
+  (`sandwich = "cluster"`) covariance is built from the same bread and is
+  equally affected, so switching sandwich type is not a remedy: inspect and
+  refit the model.
 * AR(1) support improvements: `pffr()` now automatically switches to
   `algorithm = "bam"` and `method = "fREML"` when `rho` is supplied, and
   sets `discrete = TRUE` for non-Gaussian families.