The critical tier proven on a rising loop; the board temperatures watched

forgectrl pin 76115fd: the chassis LM75 and the supply sensor ride /status
as temps (degrees and a raw count), the engine ranges them over every run
session into one run-end line, and a critical fault that clears with its
session yields the reason to the standing hold.

Bench: critical_tier_drill.py (a bench tool now, registered as
critical-tier) sets the ceiling, the resume gate and the critical line a
few tenths above the live upstream reading and lets the engine's own
flow-check heater warm the loop through them inside one M8 session;
temp_calibrate.py gains supply-watch, supply-point and supply-fit for the
supply sensor against a thermometer on its heatsink, the fit shown beside
UAPI.md's unverified guess.

Catalog: cooling.gate-off checks the /status temps fields and the run-end
board-temperature line (the unit fake mirrors both, one new failure
case); cooling.critical-tier checks the reason after a faulted session.

Docs: CAMPAIGN-LOG entries for cooling.critical-tier on dev image
20260822154257 and the warm-loop drill (OVERTEMP at 10 s, CRITICAL at
14 s, the fault ending with the session); BRINGUP item 19, the facts bank
(board temperatures at idle), COOLING section 9, the bench README.

docs/COOLING.md

@@ -435,6 +435,12 @@ Stated plainly so nobody counts on them:
   cannot be detected (the output has no readback), so this will become a user
   setting plus a simple hysteresis around the factory's setpoints.
 - **A fire watch that acts** (§7).
+- **Chassis and supply ceilings.** Both temperatures are measured and not
+  gated: the chassis LM75 in degrees and the supply sensor as a raw count,
+  in `/status` as `temps`, and ranged over every job in one log line
+  (`temps this job: ...`). A ceiling for each comes from that record once
+  there is enough of it, and the supply's conversion from a thermometer on
+  its heatsink (`temp_calibrate.py supply-point`).
 - **Fan floors measured on more than one machine.** The shipped floors are
   a fraction of one bench machine's run-duty speeds; a machine whose fans
   read differently sets its own (§8), and a floor of zero turns that gate