feat(moments): a mount that keeps arriving where it does not apply proposes its own removal (milestone 458 step 7b, #4955)

The open-after-moment signal proposes a mount; nothing proposed taking one
off, so a wrong mount was noise at every occurrence until someone happened
to notice. rule_misfired(rule_id, moment, why, reached_by) records a report
against a MOUNTED pair, counted per distinct day (the MCP door carries no
session id) on a new rule_moment_judgments.misfire column (migration 0119,
backup v24). At three days the response carries a line asking the agent to
offer the operator the fix - reject takes the rule off, unmap_action stops
the action reaching the moment, confirm keeps the mount and stops the
asking - and Settings > Moments lists it as an unmount proposal with the
reasons and the actions that reached it. A re-mount clears the count.

Taught in moments.md, missed-retrieval.md and the reply hold's wording.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_moments.py

@@ -118,12 +118,12 @@ def test_the_tools_are_registered_and_classified():
     assert mcp.names == [
         "list_moments", "map_action", "unmap_action",
         "rules_to_mount", "propose_rule_moments", "rule_moment_proposals",
-        "judge_rule_moments",
+        "judge_rule_moments", "rule_misfired",
     ]
     assert {"list_moments", "rules_to_mount", "rule_moment_proposals"} <= _READ_ONLY_TOOLS
     # A confirm mounts a rule, so a read key must not reach it.
     assert {"map_action", "unmap_action",
-            "propose_rule_moments", "judge_rule_moments"} <= _WRITE_TOOLS
+            "propose_rule_moments", "judge_rule_moments", "rule_misfired"} <= _WRITE_TOOLS
 
 
 def test_both_doors_read_one_catalog():