[MattJackson]

Door-root recipe steps 1-6 for this repo: the logic crate's only public item is door; the whole declares document rides the Statement's extensions under EXT_DECLARES.

Pin: the manifests, .busbar-ref and Cargo.lock stay at dev's busbar pin 08d4d7c501, as the migrate PR had them. statement_extensions! / EXT_DECLARES come from busbar #1399 (not at this pin; #1474 stacks on it), so CI is red until it and #1478 are at the pin; dev's pin is not moved here.

Third-party dependency rows and deny.toml are dev's: the third-party sync is not this PR's.

Earlier row-159 changes carried on this branch

LOCKSTEP with GetBusbar/busbar#1433, which pins this head and removes BUSBAR-4013 and BUSBAR-7087 from busbar's kernel catalogue. The two land together. Safe order: busbar #1202 (and the contract it carries) first, then this PR, then busbar#1433. This plugin is the only code that raises 4013 and 7087 (instance.rs note_line), and no busbar crate raises them, so the plugin owns them and keeps them in declares.json. Until #1433 lands, busbar's kernel catalogue also holds both codes, so a dropped-in build of this head refuses the boot ("the catalogue already holds that code"). Do not ship it dropped in ahead of #1433.

• Deleted the query-key style: its declaration, settings, scheme arm, Note::Query and tests. It was never selected in production. 1.5.5 never presented a credential as a query parameter: v1.5.5 crates/busbar/src/egress_auth/mod.rs:182 sends gemini's key in x-goog-api-key. The spec only permits a query-key style ("an outbound style may name a query key", BUSBAR-1.6.0.md l.863) and selects none, and no busbar crate or plane names it. Part 1 (l.1934): a capability that is never constructed does not ship.
• style.rs refusal doc: it now says the refusal texts are new in 1.6.0, not 1.5.5's words. 1.5.5 refused a credential only for oauth-client-credentials and jwt-bearer (v1.5.5 crates/busbar/src/config_validate/mod.rs:516, :543). The diag comments now name the codes and cite the 1.5.5 lines, not 1.5.5 catalogue names, because 1.5.5 had no diagnostic codes.

Confirming review: opus (fresh), PASS.

Lands with busbar #1490 / FINAL-REPIN (busbar's link rows name the old entry points until then).