feat(rustd): the repair branch names its gate, through crates rather than by hand

The branch a write-bound run may author on: the approved repository-write
gate's sixteen raw bytes, in unpadded URL-safe base64, under one namespace. It
carries no fleet and no event, so a branch visible on a repository leaks no
tenant identity — the daemon resolves those from the gate row.

`egress` locks this exact name into the request rules as the only ref the run
may create and the only head a Pull Request may open from. That is what makes
the sentence a human approved — "one branch, one draft Pull Request" —
enforceable rather than aspirational, and it is why an alias must not resolve.
`gate_of` re-encodes what it decoded and compares: padding, a wrong length, or
any other spelling of the same bytes is refused, because two names resolving to
one approved gate means one of them is a name the egress rules do not admit.

**Nothing here is hand-decoded, and the first cut of it was.** `id_format.zig`
and `repair_branch.zig` hand-write the hex and base64 conversions because Zig
has neither available to call; I ported that reflex instead of that
requirement, and wrote a nibble decoder twenty lines below `Uuid7::encode`,
whose own doc comment says hand-writing the inverse shifting is "re-deriving a
solved, tested thing, so it is not written here". `uuid` was already an
`afd_core` dependency and `base64` already a workspace one. Both conversions
are now crate calls.

`Uuid7::to_bytes` lands beside the validator rather than in the caller, so
there is one definition of what the canonical spelling decodes to. `branch_for`
takes the validated identifier and is therefore infallible — the Zig returns an
error union only because it takes a string and must re-check it, which is a
check that belongs where an identifier is made.

The lookup that says WHICH gate a lease's branch comes from is
`approvedWriteGateId`, and the dispatcher that composes it into trusted-context
instructions is §6's. This is the naming half, which §2 needs because
`egress::build` cannot bound a write binding without it.

afd_fleet 178 unit tests (was 173) · afd_core `id` 16 (was 15) — the added one
round-trips raw bytes back through the canonical text, because a decode that
silently answered zeroes would look plausible everywhere it was used.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>