feat(rustd): the money gates decide — and say which kind of no they mean

§2's money half. The gate pass answers a four-arm `Admission` instead of the
Zig's `?Billed`, where whether an event was terminally killed is decided by
whether the function happened to call `blockEvent` before returning null — six
of `runBilling`'s ten exits do, four do not, and the type carries none of it.
Admit / Refuse / Retry are now distinguishable without reading each exit, and
the terminal write is applied once by the caller as a function of the value.

Fault posture stops being a `catch`. `balanceCoversEstimate` fails open at three
separate `catch return true`; here each gate carries a `Gate` naming what its
own failure means and `Gate::absorb` applies it, so fail-open is a fact beside
the gate's name. `budget.zig` reached this on its own — its `BudgetRead` union
exists so `refusalFor` can be pure — and Rust needs no union for it: a fault is
`Err`, a verdict is `Ok`.

Two crate decisions, both against the download numbers and both recorded:
jiff over chrono/time (161.8M vs 56.6M recent) because a civil date is a type
distinct from an instant, which is what the UTC-month window turns on — the Zig
walks epoch-day → year-day → month-day by hand and carries a leap-February test
to prove it. And NO rate cache: `model_rate_cache.zig` is 300 lines of
fixed-capacity table and collision proof, but `LOAD_RATE_WITH_REVISION` already
returns the rate and its generation in one snapshot, so reading fresh costs one
round trip — fewer than the Zig's cached path — with no generation to compare.

Deliberately not rust_decimal. The authored ceiling is f64, the ledger is i64
nanos, and the daemon this must stay row-equivalent with rounds `dollars * 1e9`.
A decimal between them is more correct in the abstract and a divergence in the
only thing Invariant 5 grades.

The logging gate is clean for the first time: orly 0.7.1 fixed four of the six
known false positives, and banner/fatal — where writing to a stream IS the
design — now carry the sanctioned `// logging:` reason. PROMPT_ORLY_LOGGING_
GATE_RUST.md retires with them.

Spec amendments: §5 split along its call sites (every non-test caller traced —
the stored parser is the lease and mint verbs', the markdown parser is M178's
and M179's, none of it this milestone's), so Dimension 5.1 is the stored corpus
and M178 gains 3.4. M181 §5 gains the metrics PIPELINE it was written as if
M176 had shipped — M176 shipped spans; there is no metric instrument in the
tree — with opentelemetry_sdk's `metrics` feature replacing ~1,450 ported
lines, and 6.4 re-scoped to the overflow BOUND since the SDK spells overflow
`otel.metric.overflow` where the Zig uses `_other`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>