SAFETY-25: pin the claim-source set, so the tripwire is one

The durability claim this PR shipped was FALSE, and the reviewer of #31
disproved it by building the fix. Part 10 said, in four committed places,
that it "goes RED the day a loop-side floor is built, so the exposure
cannot change size under a green suite". The reviewer implemented the
memo's own recommended Option B in main.py - a
`Claim.limit("reserve", P_LOOP, hi=0.0)` filed under a `loop_soc_floor` -
and the ENTIRE SUITE STAYED GREEN. Part 10 green. Mutation 13 went on
printing "NOTHING PREVENTS IT, ON PURPOSE" and the same 21 % -> 10.0 %,
on a tree where something DID prevent it. Pushed to an absurd
always-binding 95 % reserve it was caught only by SAFETY-24's pre-existing
part 7 wiring checks; part 10 was still green.

THE CAUSE IS STRUCTURAL, not a missing assertion. `replay_loop()`
hand-builds main.py's claim list as a literal
`[supervised, loop, peakguard.claim(...)]`, so it is blind to any claim
main.py ADDS - which is exactly where AC 2 would be built. That is this
repository's named failure mode: a check that observed something other
than what it claimed to observe, shipped as a guarantee inside the
document that recommends the change.

THE FIX IS 10f: THE CLAIM-SOURCE SET, PINNED, two ways because the two
fail differently.

  * STATICALLY, over `Controller.cycle()`'s own AST. Every
    `claims.append(...)` in it must be one the scan can read - an
    unreadable append FAILS rather than counting as nothing, which is how
    a scan like this goes quietly vacuous - and the sources it can file
    must be exactly {device, supervised, failsafe, safety, peak,
    arbitrage, maintenance, loop}. A ninth takes part 10 red on the line
    it is written, in every configuration, whether or not any fixture
    here reaches the state that files it.
  * DYNAMICALLY, through REAL `Controller.cycle()`s with main.py's OWN
    `resolve` spied - not a list this file built and hoped matched -
    swept over the WHOLE 0..100 % SoC range in the two states 10a-10c
    replay. Idle: exactly {device, supervised, loop}. Floor-limited:
    exactly {device, supervised, loop, peak}. A claim conditioned on a
    low pack, which is the shape a loop-side floor has, cannot hide from
    a sweep that visits 0 %.

And the fold is checked rather than assumed: main.py's two P_SAFETY
rating limits are both symmetric LIMITs, so replay_loop() modelling them
as one `supervised` claim at the tighter bound is exact.

MEASURED AGAINST THE COUNTEREXAMPLE. Reproduced first on the unfixed
tree (green, as reported). On this tree the reviewer's Option B at its
recommended default takes part 10 RED on 3 checks, and the 95 % variant
on 6. Nine mutations were run in all, each against a freshly copied tree
with no `__pycache__` present, mounted `:ro`; all nine red, no survivors,
no `+0 B` delta. MUTATION.md records why a second round was needed: the
first round's mutations were all aimed at DISARMING the guard, while the
claim part 10 actually made was about the guard being FIXED.

The four false sentences are replaced with what is now true, and each
says WHICH half catches WHICH shape - 10f for an arbiter claim
(Options B and C), 10a-10c for a clamp inside control.compute() or the
guard (Option D), which the replay drives directly.

AC 2 IS STILL OPEN AND NOTHING HERE BUILDS IT. The loop-side floor was a
test mutant, reverted before commit. The memo still says "Status: OPEN.
This is a memo, not a decision."

Also, non-blocking, from the same review: the NOT READY banner had
inherited the new scope sentence and become a ~550-character paragraph
that the row three lines below repeated verbatim. A checks() row may now
carry an optional short `banner` form; the floor-limited row does, and
`status_payload()` prefers it. THE ROW IS UNCHANGED - shortening that
would have been weakening AC 3 - and rows without the key are
unaffected. Graded, and mutated: dropping the short form goes red.

Merged origin/release/1.0 first (CI-02), keeping both tickets' CHANGELOG
entries.

Full suite green: 17/17 in goodwe-addon-ci (test_ci_gate.py needs `git`,
which CI-02 added to .gitea/ci/Dockerfile but the local image lacks; run
with it installed and it passes).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

goodwe_controller/app/main.py

@@ -1453,7 +1453,19 @@ class Controller:
                 # loop goes on discharging in EVERY cycle this row is showing.
                 # A floor that binds one consumer and not the other is worse
                 # than no floor if the page does not say which.
+                #
+                # ⚠️ AND IT CARRIES ITS OWN `banner`. status_payload() renders
+                # the FIRST not-ok/not-warn row as the page's headline, so
+                # without this the loudest element on the page would be a
+                # 550-character paragraph that the row three lines below
+                # repeats verbatim. The banner is the short form; the row keeps
+                # the whole sentence, because the row is where an operator
+                # reads what the floor does and does not bound. Shortening the
+                # ROW instead would be weakening AC 3.
                 out.append({"ok": False, "warn": False,
+                            "banner": _pg.explain()
+                                      + " - and peak_soc_floor bounds THE PEAK "
+                                        "GUARD ONLY (SAFETY-25, see below)",
                             "text": _pg.explain()
                                     + ". NOTE: peak_soc_floor bounds THE PEAK "
                                       "GUARD ONLY - it is not a pack-wide "
@@ -1566,7 +1578,13 @@ class Controller:
             level, banner = "bad", ("FAILSAFE — the command opposed the meter. "
                                     "Inverter held at 0 W.")
         elif bad:
-            level, banner = "bad", f"NOT READY — {bad[0]['text']}"
+            # ⚠️ `banner` IF THE ROW OFFERS ONE, `text` OTHERWISE. A row may
+            # need to say more to an operator reading the checks list than fits
+            # in the one line at the top of the page - SAFETY-25's floor-limited
+            # row is the case that forced this - and a headline that is a full
+            # paragraph, repeated verbatim by the row underneath it, is a
+            # headline nobody reads. Rows without the key are unaffected.
+            level, banner = "bad", f"NOT READY — {bad[0].get('banner') or bad[0]['text']}"
         elif not self.auto:
             level, banner = "warn", "Stopped — inverter commanded to 0 W"
         elif self.maint.phase != IDLE: