address review round 8: skip on shared-quota 429s, unpin upstream miss shape, refresh stale comment

- in no-secret mode both zero-credit tests draw from the shared loopback
  quota that keyless.test.ts legitimately exhausts; a 429 there is
  environmental, so the tests skip instead of asserting on a bucket they
  cannot isolate
- the miss test no longer pins the upstream status shape (mostly 4xx, but
  200-empty/redirect are possible); the contract is admission without 401
  and zero usage rows regardless of outcome
- the credit-delta comment now describes per-run IPs, not fixed ones