feat(core): a quarantined device says what failed

[V3RON]

Closes #635

Status

Implement: done Review: passed (round 2) Hardware: n/a Gate: waiting for the stack

Done when

• The Tests lines above pass.
• On the fake driver, a device quarantined after a failed purge shows Purge failed: <message> in the Attention inspector and quarantineCause in simlock status --json, before and after simlock daemon stop and start (the e2e line).
• src/core/AGENTS.md Known gaps has the rollback gap (item 11).
• docs/CLI.md, docs/HTTP-API.md, docs/CONSOLE.md, docs/EVENTS.md and docs/internal/EVENTS.md describe the cause and the new payload fields.

Assumptions

• Assumption: where the HTTP-token role test lives — src/http/app.test.ts runs on a fake dispatcher that cannot strip the message, so the operator/agent token test runs through startDaemon in src/daemon/main.test.ts (real dispatcher, real HTTP gateway) instead.
• Assumption: the stalled-entry and retry-keeps-cause tests use the real Registry in a new describe in quarantine-coordinator.test.ts, because the file's FakeRegistry would only echo what the test wrote.
• Assumption: existing stalled-entry tests in quarantine-coordinator.test.ts — enterFromStalledTransition now needs the finding's state, so those tests start the target device in that state and pass it, rather than starting quarantined.
• Assumption: five red registry.test.ts physical-only state files lacked devices: [], which the loader requires; added it to the test data, no assertion changed.
• Assumption: the protocol 40 bump touches the hard-coded 39 in four existing tests (server.test.ts, daemon-protocol/index.test.ts, service.test.ts) — mechanical.
• Assumption: runCli gets a fallow-ignore complexity line; its complexity is from the base, not this task, and Fallow audits every function of a changed file.

Review

Spec review: 0 blocking, 0 fixed, 0 notes. Code review: 2 blocking, 2 fixed, 0 notes. Claims review: 0 blocking, 0 fixed, 0 notes.
Rounds: 2. Tokens: 3.8M.
Assessment: complete

Written by an agent.