fix(wake): #920 quarantine render-refused drain entry (no head-of-line block) + reconciler enumerations render orientation-tier (reconciled:true, render-tier not class=digest) (#922)

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>

packages/mosaic/framework/tools/wake/manifest.txt

@@ -57,8 +57,26 @@
 #              FAIL-LOUD, and the secret-scrub/SHA-preservation contract are all
 #              unchanged — this makes the existing scrub deterministic across
 #              runners, it does not weaken it.
+#   0.6.4  #920 digest.sh drain-quarantine + reconciler-enumeration render tier
+#              (live wake-pilot finding #6, BLOCKING). (a) PER-ENTRY
+#              QUARANTINE: a render-refused ACTIONABLE entry (no §2.1 hard
+#              locator) is now DEAD-LETTERED to $STATE_DIR/dead-letter.jsonl +
+#              a loud per-entry alarm and EXCLUDED, while the REST of the
+#              cumulative set still renders (exit 0). Replaces the whole-digest
+#              exit-4 that let ONE malformed entry wedge the entire drain (head-
+#              of-line blocking — 4 consecutive live timer failures, nothing
+#              delivered). Fail-loud is preserved, now per-entry; the bad entry
+#              is never silently dropped. (b) Reconciler ENUMERATIONS render
+#              ORIENTATION-tier: an entry whose locators carry reconciled==true
+#              (set only by reconcile.sh) is EXEMPT from the actionable hard-
+#              locator gate and renders as an orientation pointer via
+#              _locator_line's digest-class vocabulary — a RENDER-layer change
+#              only. reconcile.sh's STORE class is UNCHANGED (non-coalescing), so
+#              distinct enumerations never collapse (§2.3/T2/G3-R6 intact); the
+#              rejected class=digest alternative would have silently coalesced
+#              them. store.sh and reconcile.sh are UNCHANGED by 0.6.4.
 component=wake
-version=0.6.3
+version=0.6.4
 
 # Watch-list schema this component consumes, and the INCLUSIVE range of
 # schema_version values it supports. A wake-watch-list.json whose schema_version
@@ -72,7 +90,11 @@ schema_max=1
 #   store.sh    A2 — three-cursor durable store + drain lib.           (W2)
 #   ack.sh      A4 — RECEIVED/CONSUMED ack-wrapper (local-write + ship). (W2)
 #   digest.sh   A3 — cumulative-state digest renderer (hard locators,
-#                    two-tier trust, injection/secret scrub).           (W3)
+#                    two-tier trust, injection/secret scrub). PER-ENTRY
+#                    quarantine: a render-refused entry is dead-lettered +
+#                    alarmed + excluded, the rest still renders (no head-of-line
+#                    block); reconciler enumerations (reconciled==true) render
+#                    ORIENTATION-tier, gate-exempt.                  (W3, #920)
 #   sign.sh     A5 — non-circular HMAC signer (independent wake_id,
 #                    load_credentials by-name; fills the hmac placeholder). (W3)
 #   detector.sh A1 — per-host single-instance delta-gated detector daemon