row 155: the door path serves budget on_exhaust: downgrade as 1.5.5 did ($, ahead of #824)

[MattJackson]

Row: /status 155. This fix lands ahead of #824 (ARCHITECT ruling: #824 stays draft until this lands). $: lands alone.

What. On the door path (root/door_steps.rs, the $ step charge), a budget LimitBlocked that carries downgrade_to now re-admits the unit through that pool instead of refusing it.

• The charge lands on the downgraded pool.
• routed becomes that pool and its members, so the egress walk (DoorFar, egress_pool(routed)) dials there.
• The request family's pool label and the forward span's pool name the downgraded pool (serve.rs).
• The chain may cascade, and a visited set bounds it. Each hop requires all of the following, as 1.5.5 did:
  • the target is a pool of the section and has not been visited;
  • the visited set is smaller than the pool count;
  • the caller's grant reaches the target and every pool on its on_exhausted fallback chain.
• Neutral nouns only (pool = member set). The kernel already computes downgrade_to (governance/state.rs:2031), and no plane is involved.

Why. 1.5.5 crates/busbar/src/ingress/mod.rs admit_check (v1.5.5) re-admits through downgrade_to, and ingress/dispatch.rs:199-206 dispatches through the pool the charge landed on. Its metric label is the effective pool (finish_admitted(.., model, ..)). Before this PR, the door refused the unit OverBudget. Part 0: behaviour is identical to 1.5.5 unless signed. This came up while mapping the busbar-llm tests (F25) for the llm-default flip.

RED-able tests (root/tests/door_steps.rs, ported from busbar-llm ingress_integration_tests.rs, driving DoorSteps::charge on a governed generation):

• an_exhausted_budget_re_pools_the_unit_through_its_downgrade_pool (fee 10, cap 25): the third unit is admitted, re-pooled to value, and routes over value's members. RED: a door that refuses the downgrade block answers OverBudget.
• a_downgrade_cycle_ends_in_the_plain_refusal_naming_the_last_pool_walked: a->b->c->b ends in OverBudget naming pool 'c'. A guard that stops one hop early names b.
• a_downgrade_never_routes_a_key_into_a_pool_it_may_not_use: a key granted only frontier gets the plain refusal, and its route is unchanged.

Ledger rows touched: none expected. The root crate grows by the downgrade loop; if a root ceiling row turns red I'll report it here.

Golden. The 1.5.5 oracle has no downgrade cell; the only downgrade cells are the boot.refusal validate cells. An add-only cell has to be recorded from the published 1.5.5 binary. The path is the one 344dc1c used:

1. a script-driver cell (testing/shadow-oracle/scripts/budget-downgrade.sh, own config: a group budget on pool frontier with on_exhaust: downgrade, downgrade_to: value, three chats, capturing the last answer, the key's usage by pool and the request family's pool label), plus its cells.json row and the scripts-allowlist row;
2. busbar-release's oracle-rerecord run against that corpus, whose artifact cell, ledger row and meta are copied unchanged.

That cell lands in its own PR once the recording exists. This PR carries the RED tests now, per the ruling.

Known residual, for the ARCHITECT: on a downgrade, 1.5.5 also read the effective pool's affinity header. On the door path, the sticky position comes from the plane's arrive, which ran against the pool the caller named. The two differ only when the pools set different affinity header names.