Scope quota health to the selected goal

[cocolord]

What changed

• classify active-state todo contract failures by owning goal while preserving global registry, routing, and public-boundary failures
• make per-goal quota health use the selected goal contract errors without losing the global quota plan
• extend the goal-filter smoke to prove a healthy goal can run while an unrelated invalid goal remains visible and blocked
• document the goal-scoped health contract

Root cause

quota should-run with goal A reused the global status health bit. A legacy todo contract error in goal B therefore forced goal A into quota_skip even when goal A had an eligible advancement todo. This also produced a contradictory payload where the work lane required an attempt but the interaction contract prohibited delivery.

Impact

Per-goal heartbeat, monitor, scheduler, and accounting decisions no longer stall on another goal active-state todo semantics. Broad status and quota inventory still report every error, and global structural or public-boundary failures remain fail-closed.

Validation

• live local-private registry check: target decision changed from quota_skip to normal_run while the global plan retained the unrelated health blocker
• python3 examples/control_plane/status-goal-filter-smoke.py
• python3 examples/control_plane/status-collection-readmodel-smoke.py
• python3 examples/control_plane/quota-plan-smoke.py
• python3 examples/control_plane/status-projection-cache-smoke.py
• loopx canary premerge --from-git-diff: 17/17 selected checks passed, public boundary clean, no manual holds