The fan floors proven on a pinned image; a fan fault ends with its session

The dated record of dev image 20260822135848: the campaign of every
non-operator, non-live test at 18 of 18 PASS with the measured floors and
the operating-point rule (cooling.fan-gate-trips and the hunt leg of
cloud.mode-switch as recorded), and the unplugged-exhaust-fan drill:
AIRFLOW at the grace plus three ticks with the exhaust dead, the other
fans held, the reason relayed on the Grbl port, the replugged fan ok
inside the next session's grace.

The drill showed the fault riding into idle, where the hold canceled
jogs and would have refused the cloud print that re-proves the fan.
forgectrl pin d51dbdb: the fault ends with its run session, and the next
session judges every fan afresh. cooling.fan-gate-trips checks the
verdict is OK with no hold once the tripped session is over (the unit
fake mirrors it); its covers, and the cooling tests' shared covers, gain
src/coolfmt.* (the tree manifest carries the new files at the bumped pin,
and the lint was right to ask). cloud.mode-switch samples the hunt's gate
rows twice a second: a hunt's run phase is a few seconds long.

Docs: COOLING 3a, BRINGUP item 19, CAMPAIGN-LOG.

docs/COOLING.md

@@ -170,7 +170,10 @@ floor.
   session: a fan that has stopped moving air is not a condition to cut
   through. The fans stay at run duty (a stalled extraction fan needs every
   other fan around it running), and the reason names the fan, the reading
-  and the floor. The next job starts the gates fresh.
+  and the floor. The fault ends with the session: at idle the verdict is
+  `OK` again (a standing hold would cancel jogs and refuse the next job
+  before it could re-prove the fan), and the next session judges every fan
+  afresh after the grace.
 - **A floor of zero is that gate off** (§8a). It still measures: the first
   reading in a job that would have tripped the shipped default is logged.