fix(pump): give the peer-drop line the clock its siblings carry

`PUMP_PEER_FAIL` has FOUR emit sites in this file and three of them were
already stamped: the submit-refusal arm, the no-route arm, and the
`PRESENCE_DIAL_FAILED` arm all carry `wall_ms` and `mono_ms`. The ordinary
per-peer drop in `peer_leg_outcome` carried neither, and it was the LAST
unstamped site. That arm is also the one the ladder rigs actually fire — a
`PEER_REPLY_READ_BUDGET` expiry reclassified out of `TimedOut` by
`brain::reclassify_peer_reply_err`, so it drops one peer instead of poisoning
the round — so the only arm we see in practice was the only arm that could
not say WHEN.

The cost is specific, not aesthetic: a stall's first question is when the
budget started and how many attempts fit in the gap. A log carrying the
failure could answer neither, because the count was visible and the times
were not. Same fields, same order as the three siblings, so one grep reads
all four.

Tagged `[impl->REQ-PUMP-STAGE-TRUTH]` at the site, because that REQ already
required it: its title asks for every peer failure "stamped (wall+mono) and
peer-attributed", explicitly subsuming the 2026-07-14 unstamped seed that the
`PRESENCE_DIAL_FAILED` arm names in its own comment. The contract was written
eight weeks ago, three of four sites complied, and the fourth stayed silent.

The comment names its siblings BY ARM, not by line number. A line-number
pointer is wrong the next time anyone edits this file, and a stale pointer in
a comment is the same defect class the stamp exists to fix.

NAMING, deliberately: this rider was opened under a "65 s helper stall"
heading and that name is retired here. The 65 s turned out to be a rig
defect — four cells sharing one node identity across four ports, so a peer
held a stale path — with no pump involved at all (the web rig runs none, and
its raws carry zero `PUMP_` lines against a control showing product stderr
was captured). The clock gap is a real and separate instrument defect for the
ladder rigs, and it stands on its own claim rather than on the stall it was
found beside. A name that survives its own refutation becomes a false memory
for the next reader.

No behaviour change: one emit macro gains two fields already computed by
`now_ms()` and `mono_ms()` in this module. Consumers censused first —
`link-probe.sh` COUNTS occurrences, `cli.rs`'s two cells assert the token is
ABSENT from operator-facing text, and `twohost.rs`'s mention is a comment;
none matches the line's shape, so added fields break none of them.

COMPILE EVIDENCE, stated exactly: the CODE lines here are byte-identical to
`6383de2f`, which built and ran the twohost-web rig twice on 2026-09-08
(`--no-run` build plus both roles, exits 0). This commit adds a comment and a
traceability tag on top of that tree and nothing else, so that build transfers
to the code but is NOT a claim about this commit. This tree was not compiled
locally: a push to main was running unit on both self-hosted runners in its
window, and a local Windows build competes with it. CI at this base is the
compile gate, and the lint leg is owed once the box is free.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WAw9XAcTR8oSwzYPsqZoY2

Co-authored by: hertz