fix(networkstream): draw the random child count once; name the tests in the doc table (SUB-7786)

Two CodeRabbit nitpicks, both valid.

The randomised estimator generator had rng.Intn(6) in the loop condition, so Go redrew
the bound before every iteration instead of once. The loop still terminated, but the
child count was no longer uniform over 0..5: each step continues with probability
(5-c)/6, making 5 children ~1.5% likely instead of ~16.7% and dropping the mean from
2.5 to ~1.8. Fan-out is one of the inputs that drives a tree into the region where the
childrenMap key made the estimate undercount, which is the whole reason this generator
was strengthened, so it was starving its own purpose. Drawn once now.

The 4,000-connection row in the doc looks like it contradicts the two tests that drive
comparable process counts and assert the payload stays UNDER the limit. It does not: the
tests build synthetic events carrying only a ref and a key, ~94 B each, where a
production entry is ~530 B -- the tests bound what the code emits, the table adds the
real-world entry weight on top. Named both tests in the caption and spelled out the
difference so a reader does not mistake the residual for a failing bound.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Alon <alon@armosec.io>