serve_framed: a framed unit cut or failed after its head closes its stream as a refusal, never as whole

[MattJackson]

A framed stream whose unit stated its head but no final status was always closed by FramedCaller's drop with status 0, which the framer renders as a stream that ended whole. So a unit that was cut or failed after its head looked like a success to the client. BUSBAR-1.6.0.md §7 says a cut is told to the client (audit root-R1 leftover C2).

Node::drive_borrowed now returns the unit's outcome, serve.rs passes it to the caller through a new Stated::ended, and FramedCaller closes a unit that did not complete, and had stated its head, as a refusal. The status is refusal_status of the unit's reason, and the framer maps it into the claim's numbering. Nothing is hard-coded. Framed streams are new in 1.6.0, so the baseline is predev.

Two REDs, both failing on predev with frame-status 0 and passing with the fix:

• A plane failure after the head. The test plane's /framed/fail states its head and one message, then fails the unit when called again for the rest. The trailers carry the framer's rendering of refusal_status(PlanePanic).
• A kernel-side cut after the head. /framed/drain states its head and one message, then pends its next call. Once the client holds that message, the test reloads the plane's generation (the governed harness now keeps the test plane's driver for this). The pump cuts the unit for the drain, and the trailers carry the framer's rendering of refusal_status(Drain).

Two cases this PR leaves as they are, and why:

• The AlreadySettled arm is unchanged, because a drive that returns cannot reach it. Only the unit's own exit and the node's sweep take a unit's hold. The sweep settles only slots marked by the drop guard, and that guard marks a slot only when drive_borrowed's future is dropped before it ends. Then there is no return, and no caller to tell.
• No deadline case is tested, because served units carry no deadline: the served path calls driver.unit with deadline 0. If a deadline did fire, it would settle through the unit's own exit like the drain does, and close the same way.

On predev, a cut of the far end's transport is still reported to the unit as completion until the D2 stack's PIECE_CUT lands (#526). After that, this same path carries those cuts too.

[github-actions]

promote into predev: BOARD @e797f4883: 0 failing test row(s), 9 DENY row(s)

DENY rows (9)

gate	row	detail
construction	one-pick-site	3 production call site(s) of 'pick_among(' (ceiling 2): crates/busbar-kernel-egress/src/walk.rs:298; crates/busbar-llm/src/engine/exhaustion/fallback.rs:120; crates/busbar-llm/src/engine/pipeline.rs:8
kind-isolation	kind-isolation:deps	3 finding(s), 93 shipped edge instance(s) over 32 class(es), 93 declaration(s); 57 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge legacy -> plane busbar-llm -> busbar-plane-llm is a shipped edge w
kind-isolation	kind-isolation:test-deps	4 finding(s), 43 test edge instance(s) over 26 class(es), 43 declaration(s); 27 '[[dep]]' row(s), 0 question(s): unlisted-dep-edge cleanliness -> legacy busbar-core-admin -> busbar-a2a is a test edge
kind-isolation-ship	kind-isolation:deps	13 finding(s) over 93 shipped edge(s): ship-edge kernel -> hooks busbar-kernel -> busbar-hook-ranking is 'not-allowed': the architecture grants no kernel -> hooks edge, and the ship criterion is the a
kind-isolation-ship	kind-isolation:test-deps	18 finding(s) over 43 test edge(s): ship-edge cleanliness -> export busbar-core-admin -> busbar-export-prometheus is 'not-allowed': the architecture grants no cleanliness -> export edge, and the ship
kind-isolation-ship	kind-isolation:faces	3 finding(s) over 39 crate(s): foreign-entry crates/busbar busbar is kind 'root' and implements 'Transport' 1 time(s) in shipped source — the entry face of kind 'transport'. A trait implementation is
kind-isolation-ship	kind-isolation:legacy-drain	3 finding(s): transitional-live qa/kind-isolation.toml 'busbar-a2a -> busbar-core-admin' (legacy drain: the retiring A2A engine's tests drive the admin surface that drained into the cleanliness tier)
ship-ready	ship-ready:ship-twin	'kind-isolation-ship' is not green: kind-isolation:deps (a dependency the architecture does not grant is still in the graph); kind-isolation:test-deps (a dependency the architecture does not grant is
structure-lint	structure-lint:plane-dup:unledgered	22 finding(s): PLANE-DUPLICATE (module): 'config.rs' — a2a:crates/busbar-a2a/src/a2a/config.rs decisions:crates/busbar-plane-decisions/src/config.rs voice:crates/busbar-voice/src/config.rs (the ledger

Judged against base a2bade047: 0 new red, 0 worse, 5 standing (excused).

tests passed: 15559, failed: 0. Run: https://github.com/GetBusbar/busbar/actions/runs/37701516902 . Artifact verdict-e797f48830bd8330afe46a91cdf43396f6790c19 (failures.json, junit.xml, raw.log; 90 days).