feat: add denial-classification seam to keeper

[mfw78]

What

• Adds Venue::classify_denied(detail: &str) -> RetryAction in crates/videre-sdk/src/client.rs, a provided method that defaults to RetryAction::Drop for every denial, letting a venue marker override how its denied faults fold into the generic keeper retry path.
• Threads a DenialClassifier (fn(&str) -> RetryAction) through Keeper in crates/videre-sdk/src/keeper.rs: Keeper::new defaults to the coarse DROP_DENIED mapping, Keeper::for_venue::<V> binds both the venue id and V::classify_denied so a keeper cannot route to one venue while folding another's denials, and Keeper::with_classifier allows an explicit override.
• Folds every reconcile refusal arm (terminal fault, rate-limited-with-hint, transient) through one private refusal_disposition helper against the new Disposition enum (Release / Park { until } / left pending), replacing the previous three separately-derived branches, so reconcile and the retry-action mapping can no longer disagree.
• Extends crates/videre-macros/src/venue_marker.rs (and a small lib.rs touch) to keep the emitted venue marker impl body open, so a marker's macro-generated impl can carry an overridden classify_denied alongside the macro's own generated items; adds a test pinning that a marker override reaches the emitted impl.
• Documents the drop-class rule directly on classify_denied: only a drop-class action (Drop or DropOnRepeat) retires a stranded reservation, TryNextBlock leaves the reservation RESERVED and reconcile re-POSTs the refused body every tick.

Why

The generic keeper reconcile path previously treated every non-accepted, non-signing-required refusal with one fixed terminal/transient split, so a venue had no way to tell the keeper that a particular denial reason should back off, drop, or be retried differently from the coarse default. classify_denied gives venues that hook without making Keeper or reconcile generic over the venue (the classifier is carried as a plain fn pointer), and collapsing the refusal handling into one refusal_disposition closes the gap where the rate-limit arm, the terminal check, and the retry-action mapping could previously drift out of sync.

Closes #11

Testing

All commands run in the repo's nix develop shell (rustc 1.94.0, cargo-nextest 0.9.127) on a clean checkout of feat/denial-classification-seam (3096cae), based on origin/feat/quote-staleness-ledger. Touched crates: videre-sdk, videre-macros (5 files, +485/-68; no Cargo.toml/Cargo.lock delta).

• cargo clippy -p videre-sdk -p videre-macros --all-targets --all-features -- -D warnings - clean, no warnings.
• cargo test --doc -p videre-sdk -p videre-macros --all-features - videre_macros 0 passed, videre_sdk 0 passed (no doctests declared); ok.
• RUSTDOCFLAGS='-D warnings' cargo doc --no-deps -p videre-sdk -p videre-macros - clean, docs generated.
• just build-modules (required because videre-macros changed) - echo-venue, echo-client, echo-keeper, flaky-venue all built for wasm32-wasip2 --release.
• cargo nextest run -p videre-sdk -p videre-macros - full pass.

AI Assistance

Implementation by claude-fable-5, red-team review by claude-opus-5, PR description by claude-sonnet-5.

[mfw78]

Deferred red-team finding filed: #40 (RunReport buckets by RetryAction, so a DropOnRepeat retirement tick counts as retried, never dropped). Shepherd adoption of the seam is tracked in nullislabs/shepherd#669.