D2: a door plane states its busbar_bucket_tokens model label; no control byte or internal lane key reaches /metrics

[MattJackson]

Stacked on #559 (base p6-d2-step4). This is the ARCHITECT ruling: the money gauge's 0x1F leak plus a guard for the whole class, as its own PR right after 4a.

The defect. busbar_bucket_tokens rendered the money ledger's lane key verbatim as its model label. For a door plane that key is the kernel's internal "<plane>\x1f<entry>", or its fee lane "<plane>\x1f". Measured on the scrape: busbar_bucket_tokens{bucket="vk_…",model="decision\x1f",tier="input"} 0.

The fix: the same plane-stated label rule as #559.

• DoorBreaker::models maps each ledger lane key a door plane writes to the model label it is scraped under. The root states these through door_money_labels:
  • an entry's key → "<scope>/<entry>"
  • the plane's fee lane → "<scope>"
• DoorCells keeps these labels sticky across generations, because the ledger keeps a key's history after an apply retires it.
• metrics/money.rs renders the label the plane stated. When no label was stated, it renders the key itself only if the key is a plain name: that is the llm plane's bare model, so its 1.5.5 bytes are unchanged.
• Any other key emits no series. No 0x1F byte and no internal lane key reaches the exposition.

The class guard. Root serve::door_tests::no_label_on_the_scrape_carries_a_control_byte_or_the_lane_separator:

• It runs keyed traffic with governance on, through the llm (pools-map) rig and the decisions door.
• It refreshes both generations, then scans every label value of every sample line in the one exposition.
• It asserts there are no bytes < 0x20 and no PLANE_LANE_SEP.
• It also asserts the llm row appears as model="m0" and the decisions fee lane as model="<section>".
• Coverage on this base is the two planes served through doors.
• Coverage commitment (ARCHITECT):
  • mcp: P3 FLIP-MCP: the mcp plane served through its door on the kernel plane driver #511 has landed on predev, so when predev is rippled up this stack after DEL lands, this PR adds mcp traffic to the scan.
  • a2a and streaming: each is added to the scan by its own flip PR.
  • The scan does not stay at two planes.
• Kernel metrics::money::tests pins the label rule:
  • a stated label is used;
  • <scope>/<entry> and <scope> render;
  • a plain model is unchanged;
  • an unstated separator-bearing key is suppressed;
  • a stated label carrying a control byte is suppressed.
• RED, on Latchkey with the money rendering reverted: a label value carries a control byte or the lane separator ("decision\u{1f}"): busbar_bucket_tokens{bucket="vk_…",model="decision^_",tier="input"} 0. The kernel label tests also fail.

Proof (Latchkey)

Check	Result
fmt, clippy (all features, -D warnings)	green
busbar-kernel	all green except the base's pre-existing root_key_spelling
cdylibs, then busbar --bin (default)	640 passed, 0 failed
busbar --bin --all-features (door_tests, door_steps)	green
scrape_shape_1_5_5, metrics_scrape_boot_window, export_scrape_is_first_party	green

Oracle, llm metrics and money cells (base 3182e56 vs production head 0fc8fac030, engine 4a7a7bba). The PR head differs from 0fc8fac030 only in a test file.

• replay --baseline-version 1.5.5 --strict --id-filter '^(ops\.scrape\|metrics|neutrality\|metrics|documented\|changelog\|spend-metrics|billing\.?[^|]*\||money\.?[^|]*\||ledger\.?[^|]*\||usage\.[^|]*\||crosscut\.traps\|)'
• 40 cells selected, widened with their premise cells.
• record rc 0 and replay rc 1 on both sides.
• 46 judged rows each: 28 PASS, 15 ACCEPTED, 3 FAIL.
• The verdict and diff-hash lists are byte-identical (sha256 25717607…d418b7 on both sides).