Prove the M101 dose-model switch; record the judged dose curves

The stream harness gains rules 18 to 21: the floor is derived from the
selected model's config key at the arm and a typed $35 is overwritten;
M101 switches the rendering exactly at the boundary in both directions
with no continuous FIRE at full duty across it; a refused switch (the
spindle on) leaves the stream unchanged, and the harness resyncs with
an empty line because the core skips G-code after an error until the
sender resyncs; M2 reverts a program-scoped switch and Q1 holds. The
analog sessions pin laser_floor_analog at the density floor so the
existing duty expectations stand, and the density ladder's unfloored
run moves from a chained $35 write to the laser_floor_density key.

The catalog's laser.power-floor becomes model-aware: it reads the
configured model and the floor keys from forgectrl, switches to the
configured model with M101 so the derivation runs without a fire, and
expects $35 to be that model's floor. The new laser.power-model-switch
switches to each model with the spindle off, checks the reported
message and $35 after each switch, and checks the M2 revert. The new
mswitch bench drill runs the switch on the machine in one armed run.

Docs follow: BRINGUP's Laser control section describes the switch, the
derived floors and the measured dose response of both models; the
MOTION settings table gains the five keys; LIGHTBURN gains a Power
models section and drops the stale 30 percent floor advice; SAFETY
names the switch's refusal rule; the CAMPAIGN-LOG records the judged
depth-witness runs of 2026-08-30 and the switch's host and bench proof.

docs/SAFETY.md

@@ -203,6 +203,14 @@ would not allow.
   under a job left standing, so a long pause ends with the machine disarmed
   and the next emission needs a fresh press. The relock waits for the kernel to
   finish the queue tail so a controlled stop can never leave FIRE driven.
+- **Dose-model switch.** `M101` changes how a commanded power is rendered
+  (full-power pulses at a density, or a continuous beam at a duty). It is
+  refused with the spindle commanded on or the controller not idle, because
+  a change under fire could pair the density model's pinned full duty with
+  the analog model's continuous FIRE; between kernel runs, which end dark
+  and lead with a power byte, no torn state exists. The first run after a
+  switch leads dark (duty 0) until the commanded power lands. A switch
+  reverts at program end and on reset unless the operator made it stick.
 - **Coolant fire gates.** The armed window requires a fresh `fire_ok` verdict
   from the cooling engine (flow verification, over-temperature, the airflow
   floors on every fan, lid-IR emission witness); a stale or failed verdict