cooling.fan-gate-trips: a fan under its floor is a fault; pin the airflow gates

The acceptance catalog gains the test behind forgectrl 5a31d66: an
exhaust floor at the legal maximum must trip AIRFLOW after the grace and
three ticks (hold, fire blocked, no resume, the exhaust gate TRIPPED and
named in the reason); a purge current floor at the ADC rail must trip
the same way; an exhaust floor of zero must read off in gates_off and
trip nothing; restored, the next session must run OK with every fan at
or above its floor. Three host cases against a scripted engine that
models the grace and the readings. The covers map names src/airflow.*.

COOLING.md gains 3a (the airflow gates) and the five settings with their
ranges and bands; SERVICES.md the gate rule, the rows, the AIRFLOW
verdict and fan_gates; SAFETY.md names the floors among the verdict's
inputs; BRINGUP item 19 records the gates as in with provisional floors
and the catalog at 44. Pins: forgectrl 5a31d66, forgefirm-app 81027ff
(0.1.15+git); fetch-verified.

docs/SAFETY.md

@@ -204,8 +204,9 @@ would not allow.
   and the next emission needs a fresh press. The relock waits for the kernel to
   finish the queue tail so a controlled stop can never leave FIRE driven.
 - **Coolant fire gates.** The armed window requires a fresh `fire_ok` verdict
-  from the cooling engine (flow verification, over-temperature, lid-IR
-  emission witness); a stale or failed verdict relocks in-process. The
+  from the cooling engine (flow verification, over-temperature, the airflow
+  floors on every fan, lid-IR emission witness); a stale or failed verdict
+  relocks in-process. The
   thermal gates are settings with a wide range whose far end turns the gate
   off by value (`COOLING.md` §8a), loudly; the fresh-report rule, the
   emission witness, the dead-man and the latch are not settings and stay in