Wire post-swap monitor into live 2-policy serving (rollback was dead code)

[rylinjames]

Summary

• pro/post_swap_monitor.py and pro/rollback.py were real, well-designed, unit-tested-in-isolation code, but neither was imported anywhere outside pro/__init__.py and their own test files. No CLI path or live server code reached them. If a promoted policy regressed in production, nothing in the running system would notice or auto-rollback.
• Adds PolicyCrashTracker.force_drain() / clear_forced_drain() as an explicit external-override mechanism, kept distinct from the existing crash-count-derived drain path so a monitor trip doesn't corrupt crash telemetry those counters also drive.
• Wires PostSwapMonitor + RollbackHandler into runtime/server.py's 2-policy /act path: T1 (safety-clamp) and T3 (safety-violation webhook count) use signals already computed per-request (result["guard_summary"]["clamp_count"], result["safety_violations"]); a trip calls dispatcher.force_drain() (same mechanism an organic crash-count drain already uses) and RollbackHandler.execute() for the audit trail.
• Adds --rollback-sensitivity and --post-swap-baseline-clamp-rate to tether serve.
• T2 (action cosine-similarity to the previous model) is intentionally left unwired live. Computing it per request would mean running both policies on every call, doubling inference cost. PostSwapMonitor already supports cos_to_previous_model=None for exactly this case ("T2 not checked this episode"), so this is documented, not silently faked.
• Does not include the docker-smoke.yml fix for the same lowercase-registry-name root cause found while diagnosing this (broken since ~2026-05-10). The token used to push this branch lacks the workflow OAuth scope required to modify .github/workflows/*. Sending that fix to the repo owner directly as a patch to apply.

Test plan

• Full suite: pytest tests/, 3192 passed, 100 skipped, 0 failed (baseline before this change: 3183/100/0, the delta is exactly the 9 new tests below, no regressions)
• 6 new tests in test_two_policy_dispatcher.py: force_drain overrides routing without touching crash counters, persists across multiple predicts, clear_forced_drain restores normal routing, rejects unknown slots, and takes priority over an organic crash-derived drain
• 3 new tests in test_post_swap_rollback_integration.py: PostSwapMonitor + RollbackHandler composed against a real TwoPolicyDispatcher (not the existing rollback tests' _StubRouter, which encodes a router.set_active() API PolicyRouter never actually implements), proves T2 and T3 trips actually drain the monitored slot on the next live request, and that sub-sensitivity-threshold trips correctly do not fire

🤖 Generated with Claude Code