The coolant critical tier, with its catalog test

forgectrl pin a1875a8: cool_temp_critical_c (default 38 C) is the fail
tier above the coolant ceiling's pause: at or over it in a run session the
verdict is CRITICAL (fire blocked, hold, no resume this job), the fault
ends with the session, the settings API keeps it above the ceiling, and
its top turns the gate off.

Catalog: cooling.critical-tier (auto, 45 tests), driven through the
settings API like cooling.gate-off: a critical line at the ceiling is
refused (and undone should it ever be accepted); with the ceiling, the
resume gate and the critical line all under the coolant's temperature a
session reads CRITICAL rather than OVERTEMP with no resume and the reason
naming the tier and the coolant; after the session the ceiling alone
holds (OVERTEMP); with the critical line at its top the gate is off
(gates_off, the run-start log line) and the ceiling alone pauses;
restored, OK with nothing off. Four unit cases against a scripted engine.
_after_session takes the condition to wait for.

Docs: COOLING (verdict table, section 5, the settings table, the quick
reference), BRINGUP item 19 and the catalog count, the CAMPAIGN-LOG
paragraph for the fan-fault session rule on dev image 20260822145201.

docs/CAMPAIGN-LOG.md

@@ -3363,7 +3363,10 @@ session could re-prove the fan (a hunt clears it). Decision (operator,
 the same day): the fault ends with its session, since every session
 judges every fan afresh after the grace before anything can fire;
 `cooling.fan-gate-trips` now checks the verdict is `OK` with no hold once
-the tripped session is over. The fire alarm keeps its idle hold.
+the tripped session is over. The fire alarm keeps its idle hold. Built
+and flashed the same day (dev image `20260822145201`, forgectrl d51dbdb):
+`cooling.fan-gate-trips` PASS in 60 s, the engine reading `OK`, no hold,
+fire allowed in the smoke-clear phase right after the tripped session.
 
 ## Superseded status notes