refactor: replace six order flags with owned submodels

[luisleo526]

Exit reservation growth could pay the first surviving tracker instead of the exit that selected the source order, and an old capture could retain full-position authority after the exposure cycle changed. Reservations now carry exact source/receiver ownership and a first-admission closure cause. Only committed growth in the captured exposure reaches that receiver; an expired capture retains its ordinary finite reservation.

The Pine market-transaction interpretation now uses an exclusive source operation in compat::pine, with original quantity intent and existing placement facts replacing duplicate membership, cap and side fields. Its existing close-artifact and cohort rules remain explicit compatibility behavior. Generic native transaction/reduction lowering and the complete scheduler remain separate work.

Together these changes reduce PendingOrder direct booleans from 23 to 17 and direct members from 94 to 88. This is a bounded step toward #227 and the order-model consolidation, not a claim that six independent policies disappeared. The fill-model document retains opening ownership and generic-flag criteria, adds the current responsibilities and remaining ordering work, and is linked into the documentation site.

Internal engine/PendingOrder ABI and fingerprints advance to v7. Standalone reservation types establish reservation_expansion_v1. Public C ABI 4, stream API 1 and mirror schema 1 remain unchanged; all 142 existing mirror fields and full prefix padding are retained, with 13 appended facts.

Validation: full configured build; 16 selected native/tool checks; 33 hash and 5 mirror mutation tests; 32 pairing compiles, 20 matching links and 31 stale-link rejections. Ten additional literal settlement scenarios pass against both shipped ff54 and this candidate, covering physical FIFO rows, expanded transactions, artifact eligibility, original close quantity, exact entry identity and no replay. Independent Grok review of the exact 47-file tree is GREEN, P0/P1/P2 = 0/0/0. The optional 314 compile-only corpus lane was not selected; no old v6 result is represented as v7 proof.

Full Cloud experiment exp-order-submodels-20260910 has 72/72 measured sciences and 4,190/4,190 probes. The first attempt's six container-start failures left seven unmeasured cases; those failures are preserved. A fresh attempt reused the exact science and code bundles with an execution-only dispatch limit of 32. All 65 overlapping measured sciences agree. Final raw CSVs, counts and complete grades are unchanged against shipped ff54/741 and official baseline56; scoreboard remains 4,182 excellent / 8 strong. References, inputs, population, metrics and thresholds are unchanged.

Formal gate pineforge-pr-gate-j848s is FAIL solely target.not-positive, because the target score is zero. Publication uses the owner's standing authorization for native neutral fixes with actual zero and no individual regression. No PASS or baseline promotion is fabricated. Candidate snapshot: 8ddefa42fb5d225a66ea31d51ab8072e6f9e0e586accb475a71f7a424a9fdb1a.

Exact source/review/native/Cloud proof archive: a9c0664512edf8b6108e469477240ea688e62d29811e519c161da295fb9a1ff1 (8,708,435 bytes; all 136 indexed files verified after download). The complete 965-file audit seal was also rehashed.