Debug collection: hold_open fix, grants.rs refactor, and DEBUG-HANDOFF findings

Debug collection commit for the brokerd admin-test hang investigation (M3a
task 19). Contains:

- crates/brokerd/src/broker.rs: hold_open helper (HOLD_OPEN = 2s read-timeout
  loop) applied after forbid and after the final send in broker::handle
- crates/brokerd/src/admin.rs: hold_open applied after forbid and after the
  final send in admin::handle
- crates/brokerd/src/grants.rs: check_tool_constraints refactor (match guard
  instead of nested if)
- docs/M3a/DEBUG-HANDOFF.md: investigation results added (310 runs, zero
  hangs reproduced; stalled fsync cannot be fixed without dropping durability)

The implementer log row was committed separately (a6d81d9).

Implemented-By: OpenCode session (model recorded in docs/implementer-log.md)

crates/brokerd/src/grants.rs

@@ -311,15 +311,13 @@ fn check_tool_constraints(
                 );
             }
         }
-        "shell" => {
-            if !grant.constraints.hosts.is_empty() {
-                push(
-                    problems,
-                    file.to_string(),
-                    None,
-                    format!("{} does not take hosts", tool),
-                );
-            }
+        "shell" if !grant.constraints.hosts.is_empty() => {
+            push(
+                problems,
+                file.to_string(),
+                None,
+                format!("{} does not take hosts", tool),
+            );
         }
         "http_fetch" => {
             if grant.constraints.hosts.is_empty() {