fix(payload): reserve Gate routing metadata paths

[albertovincenzi]

Problem

The declaration contract says Gate’s root _gate object is reserved and cannot be used by cost.path or scopeBy. The validator only checked for the payload. prefix, however, so payload._gate.path was accepted. At runtime it read Gate-generated routing metadata as if it were producer data. The v1 cost compatibility shim could also write into that envelope.

Fix

• reject payload._gate and descendants in the payload-path grammar
• enforce the same boundary in resolve, so already-stored invalid documents cannot read the stamp
• prevent the v1 cost shim from writing below the reserved root
• clarify cost-path / scope-path diagnostics and the design contract
• add core validation/resolution tests plus a server regression test for the v1 write path

Review notes for Alice

Only the root _gate object is reserved; a producer field such as payload.vendor._gate remains valid. For an already-stored declaration that used the forbidden path, runtime resolution now returns absent: costs fall back to their declared default and scoped pushes are refused instead of consuming routing provenance. A redeclare receives a precise 422 validation problem.

Verification

• cargo test --workspace
• cargo clippy --workspace --all-targets -- -D warnings
• cargo fmt --check

[albertovincenzi]

This rule is retroactive on documents that are already in the store.

restore and reconcile both go through declare_from_store → declare_locked(.., from_caller = false) → validate_with, with no exception. A single Problem therefore means the graph is not registered on the next restart: its pushes answer 404 and its ingress queue fills behind one WARN line.

#66 draws the line — a stored document is refused only for nodes, paths or a name that cannot become a queue name and a kv key, and everything else is logged and kept running. Suggest basing this PR on it, or merging it first.

For #34 specifically this is not hypothetical: airbnb/content and airbnb/messages in crates/core/tests/testdata/v1_channel_go_graphs.json carry only conditional budgets, and the passthrough remedy in migrate.rs never runs again once a document has been re-saved in v2 shape.

https://claude.ai/code/session_012K8u7BEJyd6nDNMCQAgH3z