[Allocator 5/5 — after #72 and #74] Gate mixed-engine ownership cutovers

[deehw]

Stacked operational follow-up to #74 and dependent on the model scout in #72. Adds a per-model ownership audit for mixed provider unions, warnings for routable unprofiled external inventory and mixed managed/external routes, and a require-managed exit-code gate proving that a cutover has managed ready supply with no same-model external route. Includes a staged Forge rollout for Machines A, C, and D, physical runtime qualification, immutable scout selection, C model replacement, A Ollama residency management, verification, and rollback. It never treats a managed host as permission to kill an unowned process. 195 focused ownership, qualification, orchestrator, server, route, and CLI tests pass. It will be retargeted after its prerequisites merge; nothing is being merged now.

[deehw]

Qualification update: added a two-sided cutover gate: require the replacement to be allocator-managed and forbid the legacy external route. Production controller-status integration proves the gate fails while the legacy route remains and passes after removal. The live stale/empty controller also fails closed because no managed replacement is visible. Focused tests, CI, and combined regression pass. Remains Draft pending dependencies and a live Forge ownership rollout with allocator heartbeats.