F1-transport: row-grain failure_mode edge beside ObservationOutcome

[gunbai-bot]

Stacked on #7818 (same constructor). Until that merges this PR's diff shows #7818's commits too; the transport-specific change is dag/gunbc/floor_component_receipt.dag + its witness.

The collapse this undoes

floor_component_outcome_of_failure_mode is deliberately many-to-one: Infra and WitnessRed both map to Failed. That is correct for the observation record and wrong for anyone deciding what to do next — a dead runner and a genuinely false claim are different faults with different owners. A consumer holding only the Failed arm had to re-derive the class by sniffing diagnostic prose, which is exactly the string classification this module already refuses at the seed boundary.

Shape

FloorComponentRow carries the declared mode beside the outcome, at row grain. std.observation is not widened: ObservationOutcome stays the canonical record of what the transition was; the mode records which declared failure vocabulary produced it.

Both are derived from one tag in one place (floor_component_row_of_failure_mode), so they cannot disagree — a row whose mode says Infra while its outcome says Done is not constructible through the seed path. An unmodelled mode still refuses in both, so the fail-closed arm is unchanged.

ModeUnrecorded is the honest arm for the tag-built constructor, which is handed an outcome directly and genuinely never saw a mode. The seed path never produces it — it is a named state, not an Optional standing in for "not applicable".

Seed transport untouched: floor_component_row_of_failure_mode's signature is unchanged, so no Rust marshalling moved.

Consumer note

The JSON gains "failure_mode" on every row (both the concluded and not_concluded arms). This is the field the alert seam should route on instead of the Failed outcome.

Evidence

Green by execution; RED direction checked by deleting the projection line, which fails both:

• fcr_infra_and_witness_red_share_an_outcome_but_not_a_mode asserts both halves — the outcomes still agree (both Failed, so the edge did not fork the record) and the modes differ. Either half alone is satisfiable by a broken projection: renaming outcomes apart would pass a modes-differ check while breaking the record; dropping the mode would pass an outcomes-agree check while restoring the blindness.
• fcr_failure_mode_edge_agrees_with_the_outcome_mapping covers all five modes.
• fcr_red_control_tag_built_row_records_no_mode_rather_than_guessing pins ModeUnrecorded rather than letting it default to "none".

claim_executor's unreached_components_carry_planned_identity_not_placeholder still passes, exercising the real receipt write through the interpreter with the added field.