feat(rustd): the gate's write half — a card whose two halves are two types

The park tail every approval shares: mint the action, land the durable row,
record the reference a later poll resolves through. Any datastore loss is
`Parked::Unavailable` — fail closed, never a silently released run and never
a question whose answer has nowhere to land.

The trust boundary is a TYPE, not a comment. `approval_gate_detail.zig` holds
the workspace-authored half and the model-authored half in one flat struct and
keeps them apart by convention; the renderer that has to attribute the second
is a different file in a different milestone. `Stated` and `Claim` are separate
types here, so a renderer receives them separately and cannot forget which is
which — and `Claim::of` is the only way to build one, so prose that skipped the
cap or the card-safe pass is unrepresentable rather than merely absent.

The sanitizer iterates characters, not bytes. `approval_gate_prose.zig` needs a
hand-written `bidiOverrideLen` decoding `E2 80 AA..AE`, a `sanitizedLen`
pre-pass for an exact allocation, and a `needsSanitizing` pre-check so the
common path skips both — all of it work Zig has no char iterator to avoid. The
ranges are written here as the code points they are, and "a multi-byte sequence
straddling the cap" is unrepresentable rather than defended against.

Two Zig writes are NOT ported, and the reason is not taste. `fleet:gate:pending:`
has one writer and one DEL; `fleet:gate:notify:` has one writer and no reader
at all — nothing in the daemon, the sweeper, the resolver, the tenant plane or
the web application reads either. They are residue of the blocking-BRPOP gate
the async design replaced. Porting them would add two round trips per park and
two more key shapes to keep in agreement, to reproduce bytes no code has read.
Registered as a divergence: row-equivalence is the graded claim, and a Redis
key nobody reads is not a row.

`Recorded` gives the approved reach one serde spelling, so the park that writes
`stated_binding` and the mint that compares against it cannot disagree — where
the Zig hand-writes the object a byte at a time, escaping included.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>