Astra: hostfiles path cap, round 5 (confirming)

Round 4 (CODEX-REVIEW-HOSTFILES-CAP-4.md) raised two P2s. Both are fixed; see the commit after c6dc57d0.

1. Deleted and skipped together. An entry marked both no longer gets the exemption: only Skipped != "" && !Deleted is exempt.
2. Ancestor walk in superseded(). superseded() now skips a path past the cap. Only a skipped entry can be one, and any live entry beneath it is refused.

Tests:

• TestATombstoneMarkedSkippedPastTheCapIsRefused.
• TestAVeryDeepSkippedEntryCostsRestoreNoAncestorWalk: a 200,000-byte skipped path. Restore and Present complete at once; without the skip, Restore takes 15s.

The census envelope is updated, with no unit or seal change. Main hasn't moved since f97898f1.

Judge:

1. Are both round-4 P2s closed?
2. Is any other code still walking or cleaning an exempt skipped path's ancestors, or doing per-component work on it? Look across hostfiles and its callers in moves and relocation.
3. Anything new?
4. Verdict: is it ready to merge?

Give findings P1/P2/P3 with file:line. Read-only; run nothing heavy.