Fleet-module placement pass: per-module base/carve-out/fleet-class ruling + tests (audit #850 lens 1) #854

Important

Problem — 11 fleet-flavored client modules sit un-gated in the base (fleet_fallback, fleet_health, fleet_panel, hub_ops (SSH hub restart), hub_proxy, hub_credential, fleet_tunnel, fleet_writes, fleet_posture, merged_projection, vault_browser), wired unconditionally. They predate the Sep-5 boundary ruling (no freeze violation), but ADR-0004 is now ACCEPTED (amicissimo#382, merged 2026-09-06) — each needs its placement made real.
Approach — Ruling 4 of audit #850: default keep-base-when-inert (the landed #394 design — the transport is the base-side staged seam, byte-identical without entitlement; H3 fixtures prove it), gate the ops-surfaces behind entitlement staging (hub_ops.ts first: SSH-to-canonical-hub restart is unambiguously multi-device fleet-class), keep fleet_panel base (single-machine doctor carve-out), verify merged_projection/hub_* stay inert-without-entitlement by test (not by convention). Per-module: placement note in the module header + a staging-fixture assertion. vault_browser: single-machine → base (confirm).