feat(headless): FA6 finalize — ship fellowship-only, defer allegiance behind a flag

Six live runs against local ACE (testaccount/+Acdream as Leader,
testaccount2/+Horan as Recruit) converged on a clean split:

- FELLOWSHIP two-session gate PASSES live, reproduced in three separate
  runs. The decisive cross-session assertion (the Recruit bot's own
  RuntimeFellowshipState — a separate process's canonical Runtime owner,
  not the Leader's local echo — flipping IsInFellowship=true,
  MemberCount=2, LeaderGuid=<Leader>) holds every time. This ships as the
  automated gate.
- ALLEGIANCE swear never completes: ACE returns nothing at all to
  Event_SwearAllegiance (0x001D) — no 0x0274 confirmation, no 0x0020 tree
  update, no WeenieError — even at 0.005 m separation (run6's distance
  diagnostic ruled out retail's 2.0 m swear-distance gate). Ambiguous
  between an FA1 wire-builder defect, an ACE-side rule this test pair
  trips, or a drop; disambiguating needs an ACE server console this
  harness doesn't have. Filed as docs/ISSUES.md #384 and
  docs/architecture/retail-divergence-register.md AD-87.

AllegianceGateEnabled (static readonly, not const, to avoid a CS0162
unreachable-code build error from branching on a literal) gates every
allegiance-dependent stage in BOTH policy classes off by default:
Leader's WaitForVassal (skipped straight to the reconnect+teardown that
only need fellowship state), Recruit's Swear/WaitSwornSeed/Break/
WaitBrokenSeed (same). All of that code stays fully written and wired —
flipping the flag re-enables it for a follow-up investigation once #384
closes. WaitReconnectReseed on both sides now asserts fellowship-only
re-seeding when the flag is off, preserving the reconnect-idempotence
proof independent of the allegiance blocker.

The two live-run diagnostics added while investigating #384 (the
confirmation-arrival log line in HeadlessSessionHost's
OnConfirmationRequest, and LogDistanceToPatron in the Recruit policy) are
kept as permanent, clearly-labeled evidence for whoever reopens #384 —
neither is "TEMP, strip later."

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/AcDream.Headless/Hosting/HeadlessSessionHost.cs

@@ -836,7 +836,20 @@ internal sealed class HeadlessSessionHost : IDisposable
                 Runtime.CharacterOwner,
                 ResolveSkillFormulaBonus: null,
                 OnSkillsUpdated: null,
-                OnConfirmationRequest: request => _pendingConfirmation = request,
+                OnConfirmationRequest: request =>
+                {
+                    // Kept as a permanent, low-volume diagnostic — docs/
+                    // ISSUES.md #384's open question is precisely "does
+                    // ACE ever send 0x0274 for the allegiance swear at
+                    // all", and this line is the only place that would
+                    // show a positive answer once someone re-enables
+                    // AllegianceGateEnabled and reruns the gate.
+                    Console.WriteLine(
+                        $"[fa6-diag] OnConfirmationRequest received type="
+                        + $"{request.Type} context={request.ContextId} "
+                        + $"text='{request.Message}'");
+                    _pendingConfirmation = request;
+                },
                 OnConfirmationDone: null,
                 ClientTime: () =>
                     Runtime.Clock.SimulationTimeSeconds,