fix(declare): keep a stored graph running when a later rule would refuse it

[albertovincenzi]

Problem

restore and reconcile declare through the same path a caller does. A validation refusal there does not keep anybody safe: it unregisters the graph, answers 404 to its pushes, and leaves the ingress queue filling behind a single WARN line. The graph was serving traffic a moment ago, and the rule was added to stop the next declare, not this one.

That makes every rule added since a document was written retroactive. This repository's own production fixture shows the shape at risk: two nodes of the airbnb graph in crates/core/tests/testdata/v1_channel_go_graphs.json (content and messages) carry only conditional budgets. The fixture test itself passes — #34 widens the v1→v2 migration to hand such nodes a passthrough budget, and the test migrates before it validates. But migration runs once per document ever: store.rs parses as GraphDoc first and falls back to v1 only on a parse failure, and lib.rs re-saves the migrated document in v2 shape on the same key. After the first v2 boot the v1 row is gone and migrate.rs is never consulted again, so a v2 document of that shape already in the store is refused on restore and nothing repairs it.

Six open PRs add such a rule: #32, #34, #36, #37, #42, #47.

Fix

• gate_core::refuses_stored_document names the rules a stored document is still refused for: nodes, paths, application, graph-name, node-name, path-name. There is no plan to build or address in those cases.
• Every other problem is logged at WARN with its rule names and the graph keeps running.
• A caller's declare (from_caller == true) is unchanged and still refused for everything.

Verification

• cargo test --workspace -- --include-ignored against queen 1.0.5 + postgres 16
• new live regression a_stored_document_that_breaks_a_later_rule_keeps_running, which fails on master (the graph is never registered) and passes here
• new unit test pinning both halves of the rule list
• cargo clippy --workspace --all-targets -- -D warnings, cargo fmt --all --check

Review notes

This is the base the six rule PRs should sit on. It changes no rule and no caller-facing behaviour; it changes only what happens to a document that is already in the store.

https://claude.ai/code/session_012K8u7BEJyd6nDNMCQAgH3z