refactor(rustd): split the admission pass at its seams

`admit.rs` reached 414 lines — over the FLL cap, and rubric S6 would have
flagged it at review. No pre-commit gate caught it because FLL is not in the
staged set, which is worth knowing: `make harness-verify` green does not mean
file length was checked.

Split on what the code DOES rather than to fit a number: `posture` owns what a
gate's own failure decides (the `OnFault` value and the four `Gate` constants),
`gates` owns the two money reads, `mod` owns the outcome types and the order.
Each is now provable on its own — `posture` has two tests that need no database
at all, asserting the fail-open/fail-closed asymmetry directly instead of
leaving a reader to collect `catch` sites.

Collapsed the repetition the split exposed: the four-line
`match absorb { Some(stop) => .., None => Err }` appeared twice and is now
`absorb(&fault).ok_or(fault)`. Same behaviour, and it fails the right way — if
a retry gate's posture is ever changed to `Admit` the pass propagates the error
rather than silently admitting an event it could not find a payer for.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>