Channels now wait on a server-side allow_channels verdict, denied under HIPAA

What

Whether Channels is available used to depend only on the tengu_harbor flag. It now also depends on a policy verdict about allow_channels that comes from Anthropic's servers:

• A new check, cdt(), treats Channels as off unless tengu_harbor is on and an allow_channels verdict is present that is not cache_miss or route_missing. nL() now also requires nn("allow_channels").
• A new policy entry, allow_channels, labelled Channels (HIPAA-R71), is denied under the hipaa policy. It is also denied when the verdict is not cached yet (cache miss) and when the verdict is a fail-open one.
• The startup dialog now asks isChannelsOffForSession, which is the reverse of the old isChannelsEnabled question.
• The Channels status has a new verdictPending field. While the verdict has not arrived, it reads cache_miss or route_missing.
• The waiting text shown on screen is now " · web fetch, design sync and Channels wait for it".

Why

Turning the flag on is no longer enough to get Channels. Organisations under the HIPAA policy will not get it, and anyone may see Channels held back at startup until the server verdict arrives.