controls: raise the angle-mode steerSaturated threshold 2.5 -> 3.5 deg

[jrneulight]

The evidence that motivated this

• On angle-mode drives, "Turn Exceeds Steering Limit" fires in storms on windy roads while the car tracks acceptably: route 00000010--93******** logged 12 honest episodes at 29–35 mph in one drive; route 00000001--be******** ~70; route 00000027--97******** 13 in 26 minutes.
• Forensics on the storm route: every episode was a real undershoot (delivered < 0.83x during > 1.0 m/s² demand), but dominated by curve-entry lag plus sub-threshold resisting driver torque (median ~0.4 Nm against the turn — below the 1.0 Nm steeringPressed threshold). The alert was mostly telling an engaged, hands-on driver what their own hands were doing.
• The angle-error latch threshold (STEER_ANGLE_SATURATION_THRESHOLD = 2.5°) predates the angle-mode work; Ford angle mode routinely carries > 2.5° of transient desired-vs-actual error at curve entries that resolve within the same curve.

Why the fix is shaped this way

Counting sustained episodes in the logs at both thresholds: 3.5° cuts them 25 → 10 on route 00000010--93******** and ~70 → ~20 on route 00000001--be********, while every deep sustained saturation (> 1 s) carries > 3.5° error and still latches. The alert's other conditions (undershoot ratio > 1.2, |desired lat accel| > 1.0 m/s², selfdrived's 2 s recent-press window) are untouched.

The evidence afterwards

Two follow-up drives ran with 3.5°: on the windy route 00000027--97******** the remaining 13 alerts were all deep sustained undershoots (verified against delivery telemetry — no false storm), and route 0000002a--ce******** produced zero alerts with zero missed sustained saturations.

What each change is

• selfdrive/controls/lib/latcontrol_angle.py: STEER_ANGLE_SATURATION_THRESHOLD 2.5 → 3.5°, with a comment recording the angle-mode rationale.

Test it yourself

Replay any angle-mode route and count steerSaturated in onroadEvents before/after. Episodes that persist > 1 s are unchanged; the short entry-transient latches are what disappear.

Risks / limits

During a genuinely deepening saturation the alert latches slightly later (error must pass 3.5° instead of 2.5°). The undershoot-ratio and lateral-accel conditions still bound when it can fire at all, and the alert is advisory — no control behavior changes.

[jrneulight]

Withdrawn: keeping the stock 2.5 deg threshold. The opt-in hands-on alert context in #155 is the preferred remedy for the alert storms — it targets the actual cause (sub-threshold resisting hands) instead of moving the global latch point.