cow: verdict observability via a tracing-field allowlist

[mfw78]

Watch-tower harvest car. Derives from src/utils/metrics.ts (per-verdict counters), inverting its per-(owner, id) label cardinality bomb.

map_verdict emits structured tracing fields; the host converts a fixed allowlist of them to counters. Modules get no metrics WIT.

Why

Watch-tower proved verdict counters are the single most useful soak signal, and also proved that unbounded metric labels are how a keeper takes down its own exporter. The Rust-native shape makes the failure unrepresentable: counter labels are &'static str only, so a chain-derived label is a compile error, not an ops incident. Owner and watch id travel as tracing fields for logs, never as metric labels. No new WIT surface keeps the component seam clean and the mechanism reusable by other modules.

Scope

• map_verdict emits verdict= and handler_class= structured fields on a stable tracing target.
• Host side: fixed allowlist of (target, field) pairs converted to counters; everything else stays log-only.
• The tracing-field-to-counter converter lands engine-side, in the shepherd-engine host exporter on the nexum-runtime host layer; the module ships fields only.
• If the converter turns out to need nexum-runtime changes rather than shepherd-engine ones, file the [Upstream nexum-runtime] rider in the [Upstream nexum-runtime] Capability escape: omitting [capabilities] grants unrestricted host-import access #645-650 style.
• Counter set: verdicts by code, posts, refusal classes (joins the seq-2 data), parks by reason.

Done when

• Counters appear for every verdict code during the cow: anvil-fork end-to-end for the structured wire #655 anvil e2e.
• No metric label derives from chain data, enforced by type (&'static str).
• Soak evidence on 7-day unattended soak test not evidenced #65 cites the counters.

Blocked by: #652.

Blocked by: #652.