fix(status): a sibling product's outage is not our outage — estate checks leave the uptime math #5543

Root cause of today's "Degraded performance / 56.6% uptime": gatetest.ai's domain is NXDOMAIN (registrar-level — the domain no longer resolves anywhere; nothing on box 161 runs it). The estate:gatetest.ai synthetic check correctly detected it — and then filed a platform incident, dragging the public 24h uptime to 56.6% and painting Database/API/Git "Degraded" while they served every request.

The surface:/dep:/doctor: filters already encode the doctrine ("an upstream 401 is not our outage"); the estate checks were added without joining it. This PR makes the scoping structural:

• incident-recorder: estate:* results are filtered before failure confirmation, severity classification, and body construction. Estate reds can neither open, widen, nor escalate a platform incident, and cannot inflate the proportional-severity rule. All-platform-green resolves an open incident even while estate is red — so the legacy gatetest incident self-heals on the first post-deploy monitor tick.
• /status: estate reds leave the alert count, headline, and uptime windows; they render in a new "Estate watch" section labeled honestly (sibling products, never counted toward uptime). Legacy estate:-titled incidents are filtered from the uptime math so the 24h/30d figures recover immediately instead of in 90 days.
• Untouched: estate transition alerting through the spine — detection and (once the Vapron rail is wired) paging still fire. Only the scoreboard scoping moves.

Pinned by three new incident-recorder tests (no incident from estate reds; resolution despite estate reds; no severity inflation). Recorder + status suites: 59 pass on current main; typecheck clean.