Debug collection: hold_open fix, grants.rs refactor, and DEBUG-HANDOFF findings

Debug collection commit for the brokerd admin-test hang investigation (M3a
task 19). Contains:

- crates/brokerd/src/broker.rs: hold_open helper (HOLD_OPEN = 2s read-timeout
  loop) applied after forbid and after the final send in broker::handle
- crates/brokerd/src/admin.rs: hold_open applied after forbid and after the
  final send in admin::handle
- crates/brokerd/src/grants.rs: check_tool_constraints refactor (match guard
  instead of nested if)
- docs/M3a/DEBUG-HANDOFF.md: investigation results added (310 runs, zero
  hangs reproduced; stalled fsync cannot be fixed without dropping durability)

The implementer log row was committed separately (a6d81d9).

Implemented-By: OpenCode session (model recorded in docs/implementer-log.md)

crates/brokerd/src/admin.rs

@@ -4,7 +4,7 @@
 use std::os::unix::net::UnixStream;
 
 use crate::approvals::Entry;
-use crate::broker::{Broker, forbid, read_request, send};
+use crate::broker::{Broker, forbid, hold_open, read_request, send};
 use crate::grants;
 use crate::ledger::{Answer, Answered};
 use proto::{
@@ -120,10 +120,12 @@ pub fn handle(mut stream: UnixStream, broker: &Broker) {
         }
         other => {
             forbid(broker, &mut stream, id, &other, "admin.sock");
+            hold_open(&mut stream);
             return;
         }
     };
 
     // 3. The final frame; a failed send is ignored.
     let _ = send(&mut stream, id, true, response);
+    hold_open(&mut stream);
 }