fix(rustd): the constant discipline orly 0.6.8 can finally see

0.6.8's UFS leaf reads `*.rs` for the first time. `write_any.sh` had declared
the extension since the Rust packs existed while `audits/ufs.sh` read none of
it, so every Rust file in this branch had a green UFS row printed over a file
the gate never opened. Opened now: **31 violations, all of them ours.**

Resolved by RULE UFS's own three routes, never by widening what the gate
ignores:

**Named** — `COLUMN_TENANT_ID` and `COLUMN_ID` in `credentials/rows.rs` are the
one that would have cost something. Five call sites across three row types
spelled two column names inline; a schema rename that missed one compiles, and
fails at runtime on whichever credential class the reviewer did not open.
Also `INITIAL_BODY_BYTES` in both capped readers, and `KIB`,
`LONG_DETAIL_BYTES`, `CLOCK_ORIGIN_MS`, `MILLIS_PER_SECOND`,
`REQUEST_BUFFER_BYTES`, `BACKOFF_CAP`, `FAR_ABOVE_CEILING` across the suites.

**Restructured** — `redacted!` spelled `concat!($label, "(redacted)")` in both
its `Debug` and `Display` arms. `concat!` takes a literal, so no const could
replace it; what could change is that it stops being written twice. `Display`
now delegates to `Debug`, because two spellings of a redaction are two chances
for one of them to start leaking while the other stays correct.

**Pinned** — `header_limit.rs` asserts `MAX_REQUEST_HEADER_BYTES == 16 * 1024`
against `http/server.zig`. There the literal IS the contract, which is what
route (3) is for. Worth knowing: the marker must sit ON the flagged line.
Placed above the `assert_eq!`, `cargo fmt` left it three lines from the literal
and the gate still reported the file.

Also folds orly 0.6.8 itself into this branch rather than the `chore/` branch I
had put it on. Indy: *"I never asked to create a new branch for this."* The
separation would also have been the worse engineering call — the engine that
finds these thirty-one would have landed green on `main` while the code that
has them sat on a branch, and the failures would have surfaced on whatever
merged next.

Files Changed grows fifteen rows. Six are orly's managed paths; the other nine
were already in this branch's diff from earlier commits and had never been
tabled — R6 has been failing since `4f6afd6ba` and nobody ran it. Verified
mechanically this time rather than by reading, which is the trap M175 recorded:

    194 paths in diff · 0 missing from Files Changed

    bash audits/ufs.sh    →  OK: no violations across 2369 file(s)
    make lint-rustd       →  ✓ [rustd] Lint passed
    make test-unit-rustd  →  536 passed; 0 failed

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>