row 155 (A): the llm door is the default build path; llm-on-driver and proto-llm deleted

[MattJackson]

Row: /status 155 (P3 "the llm door becomes the default and busbar-llm and llm-on-driver are deleted"). This is A of the stack A -> B -> C that the ARCHITECT approved for row 155. B moves the routing tables into busbar-plane-llm. C deletes busbar-llm and its ledger rows, which also moves rows 83 and 107.

What

• crates/busbar/Cargo.toml: the llm plane has one switch, plane-llm (spec deps: bump bytes from 1.12.0 to 1.12.1 #17, one feature per plane), and it is in default.
  • It carries the door row plane-llm-door (plane-door axis; the same shape as plane-mcp / plane-mcp-door) and the auth-sigv4/auth-oauth rows.
  • Until B, it also carries the legacy engine crate's row. root::linked::doors_own_their_plane_keys already carries that row's tables (fallback, build_runtime, viewer, resolve_provider, on_swap) onto the door's row.
  • proto-llm and llm-on-driver are deleted.
• The door's K7 probe units are the plane's health probes (spec l.1190, l.2678). So no linked row carries the on-host axis for llm, and main.rs no longer needs a cfg to skip the legacy probers.
• build.rs: the linked_fold_on_driver cfg (set by any *-on-driver feature) becomes linked_driver_proofs, set by an enabled [package.metadata.busbar.driver-proofs] row. The driver-proofs row now keys on plane-llm-door. The hook gate on the driver (tests/hook_parity_driver, the door cells in root/tests/serve_tests.rs, secret_source.rs, serve.rs) therefore runs in every default test run. Before this PR it ran only under the switch, which no CI check enabled.
• Scripts, xtask gates and fixtures (teller_steps ROOT_FEATURES, reachability, planes, kind_isolation notes, verify-1.6.0-done.sh, plane-delete-test.sh, proto-deletion-gate.sh, no-plugins-gate.sh, capability-equality-summary.py) and qa notes (teller-steps.json, capability-equality.json) re-point proto-llm to plane-llm.
• verify-done's LLM-only parity leg (claim C3) now keeps plane-llm and drops every other plane-*, so the LLM-only build is the door build. Its self-test fixtures are updated to match.
• Docs: TODO l.30 is updated and the llm-on-driver transitional-debt row is removed. Spec l.4800 no longer names the feature. Historical audit records (qa/evidence/*, the security posture history) are left as written.

Why: BUSBAR-1.6.0.md Part 3 §12 "The switch": a development-only cargo feature flips a plane onto the driver during its fold and is deleted when the fold completes. FLIP-LLM (#464) landed, and this PR completes the flip.

RED-able test: crates/busbar/tests/composition_root_names_no_linked_plugin.rs::no_fold_switch_remains_and_the_default_build_links_every_plane_door replaces every_on_driver_switch_links_its_door_and_the_default_build_does_not. It goes red if a -on-driver feature returns to [features] or if a plane switch is taken out of default. In that case the default build no longer links every plane door any feature links.

Ledger rows touched: none in A. The crate edges are unchanged and only the feature names move. C deletes busbar-llm's rows with exact counts.

Oracle: C3 (LLM-only 1.6.0 ≡ 1.5.5) is judged by the oracle check on the predev -> dev move. No lane check runs it, and no cargo runs by hand. #464's strict replay of the door build was 138/138 llm cells PASS or ACCEPTED.

Gate sweep (coordinator, row 103). In the tree, no test is gated on llm-on-driver or proto-llm by cfg(feature). This PR re-keyed the switch's own cfg (linked_fold_on_driver, now linked_driver_proofs): hook_parity_driver, root/tests/serve_tests.rs door cells, secret_source.rs, and serve.rs::hook_seat_tests.
The hazard after C is gates on axes that only the legacy engine row carries (body-ingress, node, path-ingress, protocols, protocol-seams, cli-help). Once that row is gone, those tests would be skipped without anyone noticing. Handled here:

• Every integration test in crates/busbar/tests that boots a provider/model config now gates on linked_section_pools, a new linked-section row plane-llm-door = "pools" (the door Statement's declaring section). It used to gate on linked_axis_body_ingress / linked_axis_node. The files: a_1_5_5_plugin_is_refused_at_boot, boot_lines_neutrality, boot_tls_refusal_once, cli_validate (36 sites), export_otlp_delivers_spans, export_plugin_dropped_in_serves, export_request_log_file_1_5_5, export_scrape_is_first_party, export_settings_refusal_1_5_5, inbound_concurrency_shed, ledger_identity, linked_export_sinks_boot_as_their_own_kind, mcp_open_front_door, mcp_stdio_serve, metrics_scrape_boot_window, no_data_dir_neutrality, no_state_persist, plugin_log_file_boot, root_dispatcher_boot, root_listeners_are_the_connectors, sigv4_both_ways, thread_per_core_serves, traces_stream_both_doors, tracing_init_once, transport_dropped_in_serves.
• metrics_scrape_boot_window (row 103) is in the default test run. It now also asserts the 1.5.5 shape: the lane families busbar_lane_state / busbar_lane_available / busbar_lane_inflight are present, and every # HELP / # TYPE line of a family 1.5.5 exposed equals the golden's line in ops.scrape|metrics|key.

Left for C, listed here so none is lost. These are linked_axis_node / linked_axis_body_ingress sites in the root crate that compile out once the legacy row is deleted:

• production: main.rs:1032,1067 (the door money post's config-apply refresh) and root/serve.rs:1716,1752 (the K7 probe target wiring);
• test modules: root/serve.rs:3849,3857,3861,3867, root/plane_node.rs:2576, root/linked.rs:1490, root/tests/door_steps.rs (9), root/tests/serve_tests.rs (2), src/tests/tests.rs (8);
• xtask/src/tests/libtest_path_tests.rs:27 (a fixture string).

Held for an oracle run on this head (coordinator).