feat(08.1-02): re-pin measurement gates for ARG3 and extend the rollout locks (GREEN)

- The optimality gate's decode-failure message names ARG3 and the rebuild
  command (node routing/scripts/build-road-graph.mjs); the frozen D-03
  constants (OPTIMALITY_EPSILON_PCT = 0.1, REQUIRED_BASELINE_ARG_VERSION
  = 1) and the immutable alt-baseline.json record are untouched.
- The oracle sweep's graph-missing (SKIP) and decode-failure wording names
  the ARG3 binary; the seeded 200-pair symmetric-compare constants and the
  three violation classes are unchanged.
- RO1/RO2 ban the ARG3 magic 0x41524733 in the upload script's and the
  Worker's comment-stripped code: the one-path laws now cover the CURRENT
  format, not just the retired ones. The Worker keeps exactly one
  decodeGraph call, no GRAPH_VERSION, no magic, no === 2.
- measure-route-cpu.mjs is untouched here by design: its LADDER HISTORY
  gains the CH rung only once the measured numbers exist (task 3).

routing/test/rollout.test.mjs

@@ -65,6 +65,7 @@ test("RO1 upload-format-agnostic — the upload path is byte-shipping, never for
     "decodeGraph",
     "0x41524731", // ARG1 magic
     "0x41524732", // ARG2 magic
+    "0x41524733", // ARG3 magic (Phase 08.1 — the ban covers the CURRENT format too)
     "GRAPH_VERSION",
   ]) {
     assert.ok(!code.includes(token), `upload code must never reference ${token} (the migration is byte-shipping — D-01)`);
@@ -90,8 +91,9 @@ test("RO2 one decode path at the Worker — the router never branches on format"
   const calls = code.match(/decodeGraph\(/g) ?? [];
   assert.equal(calls.length, 1, "exactly one decodeGraph call site — the ONE decode path");
   // NO version-conditional branch against the graph bytes: no version
-  // constant import/compare, no magic, no `=== 2` anywhere in the file.
-  for (const token of ["GRAPH_VERSION", "0x41524731", "0x41524732", "=== 2"]) {
+  // constant import/compare, no magic (ARG1, ARG2, or the current ARG3),
+  // no `=== 2` anywhere in the file.
+  for (const token of ["GRAPH_VERSION", "0x41524731", "0x41524732", "0x41524733", "=== 2"]) {
     assert.ok(!code.includes(token), `the router must never branch on format (${token})`);
   }
 });