fix(config): reject >3 fuse phases and duplicate site meters

[Sanjin-Maker]

Summary

• fuse.phases: 4+ was accepted and then silently truncated to 3 by the dispatch freshness gate (site_dispatch_safety.go), while Fuse.MaxPowerW() kept multiplying by the configured phase count — the operator believes the extra phases are protected when they aren't. Now rejected at Validate() with fuse.phases must be 1, 2 or 3.
• A second is_site_meter: true driver was silently ignored (SiteMeterDriver() returns the first match) — dispatch could be trusting a different meter than the operator intends. Now rejected with an explicit count in the message.
• The defensive truncation in the freshness gate is left in place as belt-and-braces.

Both are load-time failures for configs that were already broken in surprising ways; the changeset calls this out.

Verification

• go test ./internal/config/ -count=1 — new validate_site_test.go covers 1–3 phases accepted, 4 rejected, single site meter accepted, duplicate rejected.
• go build ./..., plus ./cmd/ftw/ and ./internal/control/ suites green.

🤖 Generated with Claude Code

[frahlg]

Maintainer review: the validation change is small and the tests cover both failure cases. I am holding the PR rather than rewriting or merging it now because older open PRs #728, #732, #735, #736, and #797 also change go/internal/config/config.go and have file right of way under the repository rules. This branch is also behind current master and has no current check run. Once the older config work is resolved, this is a good candidate to rebase, rerun, and merge as an isolated change.

[miravoss26]

Rejects fuse.phases > 3 (previously silently truncated to 3 by the freshness gate while MaxPowerW() kept using the configured value) and rejects a second is_site_meter: true driver (previously the first match silently won). Both are load-time validation errors for configs that were already broken in surprising ways.

• Clean, isolated change. Tests cover all four new branches (1-3 phases accepted, 4 rejected, single/duplicate site meter).
• No secrets, no injection surface, no new deps, no network changes.

Safe to merge from my read.

[frahlg]

Thank you @Sanjin-Maker. This is a focused fix with a clear failure mode and useful tests, and we want to keep it open.

Several older open PRs already own go/internal/config/config.go (#728, #732, #735, #736 and #797), so they have right of way. Please do not rebase yet and do not stack more work on this branch. Once those owners are resolved, we will ask for a clean rebase onto current master, CI and the same narrow scope.

We appreciate this contribution and will keep you included as the blocker clears.