feat(supervise): pre-flight checks for bridge admission, model wire id, and tool mounts before child spend

[drewstone]

Follow-up to #822 and the "To the reporter" section of #850, which asked for this as its own issue.

Motive, measured

In the 281-run fleet measured in #822 (runtime 0.133.3/0.133.4, bridge executor, pi and claude-code harnesses), 26 children died after doing real work: 10,337,224 input tokens and 441,045 output tokens spent on children whose failures were already determined at or before materialization. Among their recorded down reasons, three classes are checkable before any spend:

count	recorded reason	pre-flight check
2	bridge 503: cli-bridge admission timed out after 30000ms (active: 12, maxActive: 12)	admission capacity
1	bridge 404: no backend matches model "claude-code/tangle-router/deepseek-v4-flash"	model wire id resolution
2	pi exit 78: requested tool "agent_runtime_coordination_kb_record" is unavailable	tool mount

5 of the 26 are directly attributed to these classes. 14 more sat under the generic execution aborted label that #820 has since split, so the attributed count is a lower bound, and the token totals above are the cost of the whole doomed cohort.

The ask

Run a per-cause pre-flight check at or before child materialization, before the child accumulates spend:

1. Model wire id. Resolve the child profile's model against the bridge's registered backends before launch. The bridge already answers this — the 404 proves it. An unmatched wire id is deterministic for a given profile + bridge, so refuse at spawn and name the id.
2. Tool mounts. The profile declares the coordination tools the child needs; for a given profile + harness pair, mountability is deterministic (pi exit 78 proves it). Validate before spend and refuse naming the missing tool.
3. Bridge admission. The bridge knows active/maxActive at dispatch. A spawn against a full bridge should be refused or explicitly queued by a scheduling decision — never discovered by a launched child burning budget against a 30000ms timeout it cannot see. This check is advisory rather than deterministic (admission can fill mid-run), but it prevents launching new children into a bridge that is already full.

Non-goal, per #850

No gate on executor-receipt-pending / executor-failed-before-receipt. That label is written only by the failure handler and read by nothing; the 41/41 correlation in #822 was a tautology, not a predictor.

Acceptance

• A child whose profile names an unregistered model wire id is refused before launch; the refusal names the exact id.
• A child requiring an unmountable tool is refused before launch; the refusal names the tool.
• A spawn against a full bridge is refused or explicitly queued; it never costs a launched child's budget to discover fullness.
• The gate reports its refusal counts. A pre-flight gate that never refuses is not a gate.

Happy to supply the #822 journals or run a targeted probe against a full bridge if that helps sizing.