census: the call row carries the demanded set, so served != lane means what it says again (#969)

[7vignesh]

What changed

Since #937 the chooser demands the SET it admitted - provider.only with allow_fallbacks: false over every machine that survived the gate, the prune, the ceiling and the quality floor - and the router must stay inside that set while being free to pick which member serves. But the call log's Record.Lane is one machine (the ranked head), so a row where served != lane can no longer tell "the router chose a different member of the set we admitted" from "the router went somewhere we never named". The census family built on it (asked ≠ served) quietly changed what it measures (#969).

• internal/calllog: add Record.Lanes []string (json:"lanes,omitempty"), the whole demanded set. callrows.Row embeds calllog.Record, so the census reads it the day it lands.
• internal/provider/calllog.go: demandedLanes(knobs) fills record.Lanes from knobs.laneChoice.Only where record.Lane is filled, under the same discipline as soleDemandedLane (only while the demand is still being sent, never off knobs the widen relaxed). Empty when the request demanded nothing or demanded exactly one - the single case Lane alone already answers, and the state of every pre-Lanes: the chooser demands the set it admitted, instead of suggesting it #937 row.
• cmd/codeaf-census/report.go: servedWasAdmitted - a row with a set agrees when served is a MEMBER of it; a row without one agrees when served matches the single ranked name. Only served landing outside counts as asked ≠ served.

Scoped to the first half of the issue. The cmd/*-replay / Policy.Demand widening the issue names as the second half is deliberately left out - it is only worth doing once the log can say whether the served machine was inside a set, which this change is.

How it was checked

• go test ./internal/provider/ -run 'TestADemandedSetLeavesEveryAdmittedMachineOnTheRow|TestASingleMachineDemandLeavesNoSetOnTheRow' - end-to-end through pacedPair (two believed-in machines behind one model, from the issue's named rig): one real demanded call writes a row carrying both admitted machines in lanes, the ranked head in lane, and served inside the set. Single-machine and no-demand calls write no set.
• go test ./cmd/codeaf-census/ -run TestServedInsideTheDemandedSetIsNotAskedNotServed - a log with three rows (served inside the set, served outside a lone name, served outside the set) reports asked ≠ served = 2 of 3, counting the in-set row as agreement.
• go test ./internal/calllog/ -short, go test ./cmd/codeaf-census/ - green.
• go vet and gofmt clean on all touched files; go build ./internal/calllog/ ./internal/provider/ ./cmd/codeaf-census/ succeeds.

Note: the full internal/calllog suite and the full internal/provider suite each have one failure on this Windows box that reproduces on clean dev with my changes stashed - TestNoTestInTheTreeWritesIntoTheLedgerOfWhoeverRanIt (a canary that runs other packages as children, several of which don't build on Windows: internal/session is //go:build !windows, others hit SQLite out of memory) and TestAFiredHedgeAndARefusedHedgeAreBothDecisions (a TempDir cleanup race on a trace file still held open). Both are pre-existing and unrelated to this change.

Checklist

• A change entry - docs/changes/unreleased/1796-demanded-lanes-on-the-row.md.
• The manual knows about it - no slash command, key, tool, default, limit or refusal moved; this refines an internal census metric with no user-facing manual claim. The dated census snapshot docs/design/recovery/census-20260910.md is a captured record and left as written.
• No new line in .github/known-red.txt.
• Only my own paths are staged.

Closes #969.