$ #74 in process: every pass and grant the loop hands a stage is bound to the unit's call

[MattJackson]

$, DRAFT: money lands alone (rule 15). Coordinator GO for the in-process half of #74.

What changes

• The loop binds the unit. run_unit_async, open_unit and exit bind an unbound unit to a fresh call (Kernel::next_call); a unit that is already bound keeps its call. UnitCtx gains call: CallId, and callers build it CallId::UNBOUND.
• Every pass and grant the loop mints is bound to that call. All 32 loop mint sites now use mint_bound(seal, ctx.call), and screened/screened_by carry the call.
• The Route stage compares. A pass that is not bound to the unit's call answers Failed(Route, Replayed).
• The money seam:
  • Hold and HoldAccrual record the call of the grant that opened them.
  • HoldCell::admit refuses a grant of another call with CellError::CallMismatch and returns the hold whole.
  • convert_at_parent_exit returns Result and gives the accrual back on a mismatch.
  • The loop answers a cell mismatch as Replayed, and a convert mismatch as Failed(Admit, Replayed) with the parent settling.
• The plane driver's probe is its own call, and its Route pass is bound to it.
• The kernel's own token vending (impl Kernel), recovery and tick stay unbound: they are host-internal and off the loop.

Overlap

• #65: the kernel seal reaches the kernel and nothing else; acquire_for_kernel is test-only #941 (non-draft) touches teller.rs l.97-104 (Kernel::new) and the caps/hold.rs module doc. Both are disjoint from these hunks.
• $ teller: the exit spends the hold by the one figure it settles at (TODO L1689) #929 (draft, $) touches UnitCtx's neighbour AccrualMeter and exit l.1313-1325. These hunks sit at l.1302-1308 and l.1327-1333, so they are disjoint but adjacent. Whichever lands second rebases.

RED tests

• the_runtime_half::a_grant_of_another_call_neither_admits_nor_converts: call A's grant does not admit call B's hold, and the hold comes back whole. It does not convert B's accrual either. B's own grant does both.
• teller::call_binding_tests::a_pass_of_another_call_is_not_presented_at_the_stage: a pass of another call is refused, and so is an unbound one; the unit's own pass is accepted. A unit is bound once.
• call_binding_tests::a_door_grant_bound_to_one_call_is_rejected_in_another (existing).

No CI yet (ModernCI outage); no laptop builds.