test: 9.5-code review minors (M1 conversion test, M5 no-fingerprint audit test, M2/M4 wording)

- M1: test_goal_branch_via_convert_queued_then_claim actually calls
  server._goal_convert_queued on a queued auto-resumed task before
  claiming, instead of only inserting the post-conversion state.
- M5: test_worker_routing_audit_rows_carry_no_fingerprint drives a
  real run_one with an active policy and asserts worker_routing
  audit rows exist and carry no fingerprint (negative control
  verified: injecting fingerprint into the detail fails it).
- M2: 'all callers' wording tightened to the real counts
  (load_routing_policy: 2 production call sites; evaluate_shadow: 1).
- M4: content_fingerprint docstring now states the fingerprint covers
  the full normalized payload including fallback_models, which the
  router deliberately does not apply (fail-safe direction).
No behaviour change; M3 DESIGN.md edits are outside the repo.

cloud/models.py

@@ -418,8 +418,12 @@ class RoutingPolicy:
         """Content fingerprint of the parsed policy (9.5-code).
 
         sha256 of the canonical JSON (sorted keys, tight
-        separators) over the fields that decide routing and
-        capability checks: mode, tiers, tier_modes,
+        separators) over the full normalized policy payload
+        (not only the fields that decide routing and capability
+        checks: fallback_models is included even though the
+        router deliberately does not apply it, so the
+        fingerprint is fail-safe — it reports more changes,
+        never fewer): mode, tiers, tier_modes,
         tier_requirements, model_capabilities, fallback_models.
         The operator-declared ``version`` string is deliberately
         NOT part of the fingerprint: it is hand-filled and may
@@ -577,7 +581,9 @@ def load_routing_policy(env=None):
         # 置位，所以部分失败不会产生任务级审计；运营方
         # 只能从 worker 日志看到它，不能从审计里查到。
         # 这是已知缺口（非静默，但不如全失败可见），
-        # 改动返回类型会牵动全部调用方，本轨不改。
+        # 本轨不改返回类型：生产调用点只有 2 处（server
+        # 影子端点经 _load_routing_policy、worker 派发），
+        # 真正的成本是同步改调用方与测试，而不是“牵动全部”。
         _logger.warning(
             "routing policy partially failed (%s); continuing with"
             " the usable source", "; ".join(failures))