feat(renderer): reach the solver tier on hosts that block datacenter addresses

[us]

What

Some origins answer a datacenter address with a plain block page and only serve
their challenge once the request arrives from a residential one. The decision to
route to the solver tier was taken from the ladder's body alone, before the
residential retry ran, so on these hosts it was always no: the retry then
uncovered the challenge, detected it, and threw the verdict away. The tier sat
configured and idle while every such request returned a block.

The residential retry's own verdict now opens that route.

Changes

• renderer.cloak_after_egress (default off) lets the solver tier fire on a
  challenge the residential retry uncovered.
• The retry's breaker verdict counts a challenge as the site blocking us rather
  than the tier misbehaving, but only for the shape that is routed onward, so an
  unrelated vendor wall still trips the breaker.
• The solver runs on a budget sized from renderer.cloak_timeout_ms whenever
  the remaining request time cannot fit a whole attempt, on both routes. The
  sidecar refuses an attempt it cannot finish, so a partial budget wasted the
  slot.
• renderer.cloak_pool_size makes the tier's concurrency configurable instead
  of a fixed 4. This is the box-wide throughput ceiling for the tier.
• A counter for how often the route becomes eligible, incremented whether or not
  the flag is on, so the arrival rate is measurable before enabling it.
• One log line per solver result with the host and which route fired.
• The current Cloudflare block-page template is classified as cloudflare
  rather than generic_block: the previous arm keyed on a marker the template
  no longer contains. Response label only; no tier reads it.

Behaviour with the flag off

Unchanged, except the vendor label on Cloudflare block pages. The error code
stays the same.

Deploy caveats

• Default off. Set CRW_RENDERER__CLOAK_AFTER_EGRESS to enable, and only
  alongside a sidecar that can serve it.
• CRW_RENDERER__CLOAK_POOL_SIZE must be raised together with the sidecar's own
  concurrency and memory, or the engine hands out permits nothing can serve.
• Enabling it adds a solver attempt to requests that previously returned a block
  immediately, so those get slower before they get answers.

Verification

• cargo test -p crw-renderer --features cdp,cloak --lib: 1005 passed
• cargo test -p crw-crawl --lib: 464 passed
• cargo test -p crw-core --lib: 513 passed
• cargo clippy -p crw-renderer -p crw-crawl -p crw-core --all-targets -- -D warnings: clean
• cargo fmt --check: clean

New tests cover the route firing on a real captured block page, staying out on a
non-Cloudflare wall, both budget cases, the breaker verdict following the flag,
and the pool default. The block-page fixture is a real capture with the host, ray
ids and origin address scrubbed.

Not yet verified end to end against a live wall; that needs the paired sidecar
change and a staging run.