Say govips gives pixa no way to stop an encode; give AVIF's worst case

libvips can stop a running encode, but govips gives pixa no way to ask
it to, which README.md "Routes" and the Process and encode comments
now say in place of "libvips cannot stop an encode". The avifEffort
comment gives its 51 seconds as the RGB time and 110 seconds with an
alpha channel as the worst case, as README.md does.

Model: opus-5-5

TODO.md

@@ -38,16 +38,16 @@ P2: security: per-origin rate limiting
   slot back, when the context has ended by the time it has the slot or before it
   encodes. A request that waited for a shared transcode stopped at the first
   request's deadline is answered 503 `server busy, try again later`, not 500,
-  though its own `downstream_timeout` may not have ended. libvips cannot stop an
-  encode once it has begun, so that encode keeps its slot until it finishes; the
-  limit of 8192 on each side of the source and of the output bounds how long
-  that takes. With one libvips thread, 8192x8192 random pixels take up to about
-  1 second to encode as JPEG, 15 as PNG, 16 as GIF, 63 as WebP, 110 as AVIF and
-  96 as JPEG XL, the last three with an alpha channel, plus up to about 11
-  seconds to decode the source; `README.md` gives these times and no longer says
-  the work stops when `downstream_timeout` ends. The settings of the WebP, AVIF
-  and JPEG XL encoders, which can hold a slot past the default
-  `downstream_timeout` of 60 seconds, are unchanged.
+  though its own `downstream_timeout` may not have ended. govips gives pixa no
+  way to stop libvips once an encode has begun, so that encode keeps its slot
+  until it finishes; the limit of 8192 on each side of the source and of the
+  output bounds how long that takes. With one libvips thread, 8192x8192 random
+  pixels take up to about 1 second to encode as JPEG, 15 as PNG, 16 as GIF, 63
+  as WebP, 110 as AVIF and 96 as JPEG XL, the last three with an alpha channel,
+  plus up to about 11 seconds to decode the source; `README.md` gives these
+  times and no longer says the work stops when `downstream_timeout` ends. The
+  settings of the WebP, AVIF and JPEG XL encoders, which can hold a slot past
+  the default `downstream_timeout` of 60 seconds, are unchanged.
 - 2026-10-15 a cached variant is served while its source URL is in the negative
   cache (closes #245): `Get` checked the negative cache before the variant
   cache, so once a fetch of the source failed, as one does when another variant