R-389: key the operator cooldown per app for app_start_failed; gate 11 makes an unfiled observation refuse the push

The cooldown key was customerID:eventType plus the tier and run suffixes, and
none of them names an app, so every app going down inside the same hour
collapsed onto one key and only the first was mailed. Measured on demo-hp:
bookstack sent 09:27:51, privatebin suppressed 09:31:51 under
key=demo-hp:app_start_failed.

cooldownStackSuffix is the third sibling of cooldownTierSuffix and
cooldownRunSuffix, and separate for the reason the second one's docstring
already gives: the existing two keep byte-identical semantics for every type
that uses them.

It is ALLOW-LISTED to app_start_failed and takes the event type as well as the
details, unlike its siblings, and that asymmetry is the safety property. The
backup family's cooldown is coarse ON PURPOSE (R-97a, R-182) so one full disk
sends one digest rather than one mail per app - and crossdrive_failed is
severity error, reaches the operator leg, and carries stack_name through a
DIFFERENT struct, so a payload-shape rule would have split it silently. The
hour itself does not change.

Gate 11 refuses a push whose REPORT.md carries an observation with neither
`FILED: R-NNN` nor `NOT-A-FINDING: <reason>`. It deliberately does NOT accept a
passing mention of some other R-number: the lost item cited R-182 as an analogy,
so "cites a register row" would have passed the very item the gate exists to
catch. That discrepancy with the spec is recorded in the gate's docstring.

Registered here and in the controller and agent runners. NOT in the catalog
runner - it has no shared-gate mechanism and appends --all to every gate;
filed as R-391 rather than left as a sentence, which is this session's lesson.

PROMPT-TEMPLATE.md §15.9 corrected: "documented, NOT acted on" was the wording
that invited the gap, and it now names the markers and points at the gate.

R-390 filed for the golden-bake runbook's missing `pveam update`.
Hub tests 709 -> 716.

REPORT.md

@@ -111,10 +111,16 @@ produced **no** warning — the guard does not fire on the normal path.
 R-329 and R-386 compressed into CLOSED with their rules kept; **R-387** (closed) and **R-388** (the
 notification-model product decision, open, operator's call) filed.
 
-## 10. Observations — recorded, not acted on
+## 10. Observations
+
+> **Markers added 2026-08-24 (gate 11, R-389).** Item 1 is the finding that had no row; adding its
+> marker is the first thing the gate ever asked for. The observations' text is unchanged.
 
 1. **The operator cooldown key carries no app identifier.** PrivateBin's alarm four minutes after
    BookStack's was logged `suppressed — operator cooldown 1h, key=demo-hp:app_start_failed`, so **only
    the first app-down per hour reaches the operator by e-mail**. R-182's known shape; harmless while
    the event was undeliverable, and no longer. Not fixed here.
+   FILED: R-389
 2. Two probe events remain as rows for `demo-hp` from Scenario H — inert, and named rather than left.
+   NOT-A-FINDING: two inert event rows on a Tier 0 demo box, created deliberately as a live
+   control and named in that session's teardown; they carry no state and nothing reads them.