refactor: audit batch 3 (I-3 capability verdict, I-4 policy merge)

- I-3: new models.evaluate_capability returning a CapabilityVerdict
  (ok/missing/unknown from check, known/unknown_missing from split,
  status/verb derivations); decide_routing, worker gateway check,
  worker persisted recheck, dry-run tier+gateway checks and server
  shadow endpoint all call it. Blocking rules stay at the call
  sites (gateway has no worker-default fallback, recheck blocks
  only on known, dry-run/shadow never block); all user-visible
  audit details, dry-run notes and shadow notes are byte-identical.
- I-4: new models.merge_policy_documents shared by
  load_routing_policy and dry_run_from_env; the old tiers-update
  block is kept verbatim (it was a no-op after update(): JSON
  tiers replace the whole map, file tiers absent from JSON are
  dropped -- preserved, not fixed, as that would be a behaviour
  change). dropped_tiers/partial_failures remain load-time
  records, not merge products.
- Tests: test_audit_batch3.py, 13 tests (verdict matrix + parity
  with check/split, decide/dry-run wording, merge boundaries +
  300 seeded random pairs + loader/dry-run agreement).
  Full suite: 1694 OK (skipped=11), baseline 1681 + 13, 0 failures.

cloud/server.py

@@ -70,7 +70,7 @@ from cloud.auth import AuthStore
 from cloud.coordinator import parse_parts as _coord_parse_parts
 from cloud.coordinator import validate_parts as _coord_validate_parts
 from cloud.cost import CostStore, unpriced_token_cap
-from cloud.models import check_model_capabilities as _check_caps
+from cloud.models import evaluate_capability as _evaluate_capability
 from cloud.models import load_routing_policy as _load_routing_policy
 from cloud.routing_shadow import evaluate_shadow as _evaluate_shadow
 from cloud.db import connect as _db_connect
@@ -4348,12 +4348,12 @@ class CloudControlPlaneHandler(BaseHTTPRequestHandler):
                             "model": None, "missing": [],
                             "unknown": False}
                 else:
-                    _ok, _missing, _unknown = _check_caps(
+                    _verdict = _evaluate_capability(
                         _policy.model_capabilities, _model, _req)
-                    _cap = {"status": "ok" if _ok else (
-                        "unknown" if _unknown else "fail"),
-                        "model": _model, "missing": _missing,
-                        "unknown": _unknown}
+                    _cap = {"status": _verdict.status,
+                            "model": _model,
+                            "missing": _verdict.missing,
+                            "unknown": _verdict.unknown}
             _bucket["capability"] = _cap
             if _cap["status"] in ("fail", "unknown"):
                 _cap_flagged.append(