fix(tracking): record negative savings instead of clamping to zero

When rtk emitted MORE than the wrapped command, record() saturated saved to 0
and reported a fake '0% — did nothing' instead of reflecting the regression.
Compute saved as signed (input - output) and store the honest negative in both
saved_tokens and savings_pct. Aggregate readers clamp a negative to 0 for their
unsigned token-count API so a regression can never wrap to a huge usize, while
per-command savings_pct keeps the honest negative. Covered by a new test.