Fast-path eligibility now records why it declined

The check that decides whether a request can use the fast gateway path now returns a reason along with its yes/no answer, so refusals can be reported in diagnostics. The answers themselves are unchanged.