D2 step 3: route input, host vocabulary and DispatchScope leave plane_host; TLS is the connector's

[MattJackson]

D2 step 3, stacked on #546 (base p6-d2-step2). No predev hop runs on this base.

What moves

• build_input.rs becomes crate::route_input, beside route_tables. ConfigTables::of no longer names any plane_host type.
• The host vocabulary becomes crate::plane::host: EngineHost and its slices, PlaneSlots, ContainerGateSink, and the gauntlet with its runner registries. slots_through moves beside it into crate::plane.
• DispatchScope and its vocabulary become crate::plane::dispatch_scope (spec Part 3: "DispatchScope stands").
• session_meter becomes crate::governance::session_meter. It cannot go in busbar-kernel-ledger, because it names EngineHost and MeterPin.
• EgressTrustHost, its install/get and PassThroughEgressTrust move into crate::secure, beside SecureLayer.
• GuardedEgressTrust moves to busbar_core_connector::tls::trust, and the root installs it.
• The SPKI DER walk moves to busbar_core_connector::tls::spki, together with its walk tests. The connector owns pinning (spec Part 3):
  • SecuredIo::peer_leaf becomes peer_spki(), which the connector's wrap computes once at handshake time.
  • The kernel's observe path reads that pin and never walks DER.
  • The kernel's TLS double reports a fixed per-leaf test pin.
• The connector's real-handshake pin test gains an explicit RED arm: a look-alike key's pin never matches.
• identity.rs and trust_anchor.rs stay where they are and die with the HOT deletion (coordinator ruling; agreed with switch-cold).

Row 82: 19 production files (plane_host 15, proto 3, store/planes 1). It was 24 at #546.

Proof (Latchkey)

Check	Result
fmt, check (all features), check (no default features), clippy (all features), clippy (default)	0
gates construction and door-only, plus --selftest of each	0
cdylibs: frame, driver, example	0
connector, core-admin, a2a, voice	0
cargo test -p busbar --bin busbar and root tests (incl. plane_meter_seam_reachability, plane_host_universal_purity, metrics_scrape_boot_window, route_tables_on_the_shipped_binary)	1424 passed, 0 failed
busbar-kernel	3037 passed, 1 failed

The one kernel failure is root_key_spelling in auth/inbound.rs. It is pre-existing on the base (from the llm lane) and is not touched by this PR.

[github-actions]

promote into p6-d2-step2: NO VERDICT @398a7cbf7

The hop ended without writing a verdict (runner lost, timeout, cancel, or it died before the engine judged): preflight: failure at step Run cargo run --locked --release --no-default-features -p busbar-release-cli --bin busbar-release -- ci preflight; publish: runner lost at step Run bash "$GITHUB_WORKSPACE/busbar-release/ci/promote/fallback.sh", Post Run actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1.

No failing-test list exists for this run. Run: https://github.com/GetBusbar/busbar/actions/runs/37614695900 . Re-run the hop, or read the job's step list in the run page.

[MattJackson]

Closed (dead, not superseded): this D2 step is not on predev, and its base DEL (p3-flip-llm-del, under #526) was deleted unmerged. By ruling, D2 lands after #464 and DEL. That sequencing now waits as task draft-546-d2-kernel-stack (After: #464), which starts from the bundles. Branch bundled at ~/Library/Caches/busbar-release/salvage/GetBusbar_busbar-p6-d2-step3-1791610783.bundle (DEL and the never-pushed ripples onto it are in GetBusbar_busbar-p6-d2-stack-local-ripples-and-del-*.bundle) and deleted.