fix(engine): split contain_node proposed/eligible metric labels

[thejefflarson]

Problem

record_contain_node("proposed", …) fired twice per pass for a newly-proposed, rails-clean ContainNode: once edge-triggered over ledger_delta.proposed (Engine::process's ledger-delta loop) and again level-triggered in the evaluate_proposal Proposed arm. Both call sites shared the same proposed label, so a fresh proposal was counted twice in that pass.

Approach chosen

Distinct labels (over dedup): the two events are genuinely different operator-facing signals —

• proposed (unchanged): edge-triggered, fires once, the pass the ledger first surfaces the mitigation at all (fires even under mode: audit).
• eligible (new): level-triggered, fires every pass the same mitigation stays armed at the node rung, in enforceScope, and every deterministic rail passes — the stronger claim "this is currently a rails-clean, actionable proposal". This term was already used in the surrounding doc comments ("ELIGIBLE to be surfaced as an actionable proposal"), so it lines up with existing vocabulary rather than inventing a new one.

Label vocabulary stays closed (proposed/eligible/reverted/rail_refused + fixed reasons) — no new per-node/high-cardinality dimension. No behavior change beyond the metric labels.

Testing

• engine/src/engine/metrics.rs::tests::a_single_pass_never_double_counts_one_label — new focused unit test. The prior test for this counter was a no-op smoke test (constructs the no-op global meter, asserts no panic), so it couldn't have caught this. This test wires a local SdkMeterProvider + InMemoryMetricExporter (not the process-global meter, to avoid racing other tests in the same binary) via a new EngineMetrics::from_meter constructor, records one proposed + one eligible event (mirroring one pass over a single fresh proposal), and asserts both labels read back as exactly 1. Verified it fails (left: Some(2)) against the pre-fix code (both calls using "proposed") and passes after the fix.
• Extended the existing smoke test to cover the eligible event.
• cargo fmt --all -- --check, cargo clippy --all-targets --all-features -- -D warnings, cargo build --all-targets, cargo test --workspace all green (1213 passed, 0 failed, 2 ignored).

Closes JEF-766