host/taint: a self-claimed pid is not provenance (F11-1)

Boundedness now requires a strong key, or a key-4 value backed by a
**resolved Client** — an unambiguous Client yielding Some(pipewire.sec.pid),
read before pipewire-pulse suppression. A node whose Client cannot be
resolved at all is unbounded whatever `application.process.id` it puts on
itself, so it can no longer spare itself from `propagate_unresolved_owner`'s
sweep with a value it made up.

Closes the round-11 review's finding 1: the key-4 union could *reduce* taint,
because the same key list feeds boundedness and the sweep is armed by an
UNbounded tainted reader. The recorded three-step path (reader bounded by its
Client's real pid, output leg on an ambiguous Client claiming a bogus pid, no
shared key so no bridge either) is now a test.

Bridging is untouched: it still uses the full union, so boundedness is stored
on OwnerKeyIndex rather than re-derived from the key set, and `bounded_by` is
the single implementation of the predicate.

Five-case Client matrix as tests (absent · ambiguous · unique-but-pid-less ·
resolved-native · resolved-to-pipewire-pulse). The pid-less row is the one
that distinguishes the correct reading of "resolved" from "a unique Client
exists", which would have left the hole open. Mutation-verified: dropping the
provenance test fails four of the six rows and passes the two that must not
regress.

Measured cost on the live graph: zero. Before- and after-binaries audited the
same graph simultaneously (tagged producer + parec on the monitor as a real
tainted reader, so the sweep was armed) — 181 records each, the same 14
distinct decision states, none exclusive to either side, no unresolved-owner
on either, eligible half non-empty throughout. O5 unmoved.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/host/taint/mod.rs

@@ -904,7 +904,10 @@ fn propagate_owner_bridge(
 /// unknown than one we can** (Codex round 3 — the mirror image of the
 /// round-1 case):
 ///
-/// - A *bounded* tainted reader has a strong key or a usable PID, so its
+/// - A *bounded* tainted reader has a strong key, or a usable PID **backed by
+///   a resolved Client** (F11-1 — a node's self-claimed
+///   `application.process.id` no longer bounds anything on its own; see
+///   [`owner::owner_is_bounded`]), so its
 ///   siblings are exactly the output legs sharing that key. Any output leg
 ///   that is *itself* bounded by a **different** key is provably a different
 ///   owner and stays eligible; only unbounded output legs are its possible