egress seams: HOSTLESS moves onto the plane's build context (EGRESS_TRUST measured, not moved)

[MattJackson]

Two process-global egress seams were in scope: HOSTLESS (egress/seam.rs) and EGRESS_TRUST (egress/trust/mod.rs). This PR removes HOSTLESS. EGRESS_TRUST is unchanged here. Its shape is given below.

HOSTLESS: removed

Readers. seam::hostless() had one production reader: send_pinned_buffered / send_pinned_stream, which are called only by the A2A plane's ReqwestTransport (execute, post_stream). That transport is built in three places:

• the plane's build hook (from_config_carrying, the relay bundle)
• a2a_start (the boot-built per-agent card transports)
• verbs::look (an operator verb's probe)

All three are built from the plane.

Handle. BuildCtx gains hostless: EgressDriver. The App build fills it with EgressDriver::core(), which is core's CoreHostlessEgress where the egress seam is compiled. A2aPlane stores the driver it was built with. LiveCardFetch::new / presenting and ReqwestTransport::driving carry it to each transport, and send_pinned_* take it as an argument. The static, install_hostless_egress, hostless(), the root's register_seams install and the test kit's install_root_egress are deleted. Literal BuildCtx test sites state Default::default(); the busbar integration tests that build real planes state EgressDriver::core(). A transport that a2a's own unit test builds bare runs on the core driver (tests/egress_boot.rs), which is what the old test-only install gave it.

Ledger. In qa/door-only.toml, the door-only:static-seam row for crates/busbar-kernel/src/egress/seam.rs / HOSTLESS is struck.

RED. a2a/tests/egress_seam_tests.rs::each_plane_relays_on_the_driver_its_own_build_was_handed builds two planes in one process over two driver doubles (201 / 202). Each plane's unary and streamed hop answers with its own driver's value. Under the first-install-wins static, both planes read the same driver.

The linked_egress cfg is still emitted by linked_gen (and its test still expects it), but the root no longer binds anything under it.

EGRESS_TRUST: not moved, still a static

Moving it is well over the size budget, and several readers have no handle that carries the value today:

• secure::layer() is read by the engine client build (engine/mod.rs spec.tls.or_else), ClientIdentity::from_pem (called at a2a config resolve) and the duplex wss dial.
• InstalledResolver is read by the duplex dial and the plane_host FFI egress open (plane_host/egress.rs, which row 74 F25: the door path's jwt-bearer mint keeps 1.5.5's raw aud, the stripped dial and the Basic #922 also edits).
• destinations_applied is called from appbuild.rs InstalledLimits::keep (edited by row 130 E6: the plugins.fetch download leaves busbar-kernel and rides the one connector (stacked on #804) #805 and row 74 F25: the door path's jwt-bearer mint keeps 1.5.5's raw aud, the stripped dial and the Basic #922).
• The engine resolver's judged / judged_name / judged_answer serve every EngineSpec::pooled_webpki client: busbar-llm build_runtime/tables, busbar-voice mount, and kernel preflight (preflight is edited by row 130 E6: the plugins.fetch download leaves busbar-kernel and rides the one connector (stacked on #804) #805).

EngineSpec already has judge/tls/dns fields, so the move is to make every spec constructor take the trust handle from its caller. The root installs the value after config load, so it would ride the App build input. That touches about 45 EngineSpec test sites and hunks that #805/#922 also edit. The ledger row itself names the plan: "struck when D1-D6 move onto conns (Phase B)".

[MattJackson]

Rule 20 note from #1031 (row 155, draft): disjoint hunks in root/linked.rs (hot_answer_inline's cap reads busbar_kernel::proxy::max_translate_body_bytes) and root/tests/door_steps.rs (one test appended). A test merge is clean.