The coolant critical tier, with its catalog test

forgectrl pin a1875a8: cool_temp_critical_c (default 38 C) is the fail
tier above the coolant ceiling's pause: at or over it in a run session the
verdict is CRITICAL (fire blocked, hold, no resume this job), the fault
ends with the session, the settings API keeps it above the ceiling, and
its top turns the gate off.

Catalog: cooling.critical-tier (auto, 45 tests), driven through the
settings API like cooling.gate-off: a critical line at the ceiling is
refused (and undone should it ever be accepted); with the ceiling, the
resume gate and the critical line all under the coolant's temperature a
session reads CRITICAL rather than OVERTEMP with no resume and the reason
naming the tier and the coolant; after the session the ceiling alone
holds (OVERTEMP); with the critical line at its top the gate is off
(gates_off, the run-start log line) and the ceiling alone pauses;
restored, OK with nothing off. Four unit cases against a scripted engine.
_after_session takes the condition to wait for.

Docs: COOLING (verdict table, section 5, the settings table, the quick
reference), BRINGUP item 19 and the catalog count, the CAMPAIGN-LOG
paragraph for the fan-fault session rule on dev image 20260822145201.

docs/BRINGUP.md

@@ -579,7 +579,7 @@ under the domain model from the day's earlier dev images) and the export reads "
 YES" for that image's manifest. That authorizes a release; it is not one
 until `releases/v<version>/acceptance.json` is committed.
 
-- **Catalog: 44 tests** in `forgetest/forgetest/suite/`, every one a port of a
+- **Catalog: 45 tests** in `forgetest/forgetest/suite/`, every one a port of a
   proven bench drill or a bench-verified check — the always-required core
   (`image.health`, `kernel.latch-locked-idle`, `kernel.k1-k2`,
   `kernel.fire-line`), `forgectrl.*`, `logs.*`, `update.*`, `motion.*`
@@ -1369,9 +1369,15 @@ Open items only. Anything closed is in `CAMPAIGN-LOG.md`.
     ends with its run session (decided; a standing hold at idle canceled
     GRBL jogs and would have refused the cloud print that re-proves the
     fan), since every session judges every fan afresh after the grace;
-    `cooling.fan-gate-trips` checks it, bench run owed on the next image.
-    The coolant critical tier and the watch-only board temperatures
-    follow.
+    `cooling.fan-gate-trips` checks it, PASS on dev image `20260822145201`.
+    **The coolant critical tier is in:** `cool_temp_critical_c` (default
+    38 C, 6 to 70, off at 70, kept above the ceiling by the settings
+    cross-check) is the fail tier above the ceiling's pause: at or over it
+    in a run session the verdict is `CRITICAL` (fire blocked, hold, no
+    resume this job), the fault ends with the session, no header touches
+    it; `cooling.critical-tier` in the catalog (45), bench run owed on the
+    next image, plus the heater-driven warm-loop drill to the critical
+    line. The watch-only board temperatures follow.
 
     Nothing here can put energy where it was not commanded: the hardware chain
     is the emission boundary and no header field touches it, and forgectrl runs