Astra: hostfiles path cap, round 6 (minimal design)

After round 5 (CODEX-REVIEW-HOSTFILES-CAP-5.md), Paul ruled that no over-cap entry is exempt. Every attempt to tolerate one in the readers opened a new edge.

The branch now differs from main (f97898f1) only by:

• the exported hostfiles.RestorableWithinCap(m) error, which is manifestWithinCap: every entry, live, tombstoned or skipped, within the cap;
• its test;
• an envelope-only Plan 14 overlay.

Readers, writers, Restore and the scan are main's, byte for byte.

Judge:

1. Does the diff against main contain anything beyond that?
2. Is RestorableWithinCap exactly the rule every reader applies, so that a manifest passing it can't be refused by checkManifest for the cap?
3. Is the census overlay correct (envelope-only, legacy seal unchanged)?
4. Verdict: is it ready to merge?

Give findings P1/P2/P3 with file:line. Read-only; run nothing heavy.