atenet: classify a 403 route outcome as denied, not resume_error - #2534

Problem

classifyOutcome in cmd/atenet/internal/router/extproc/metrics.go maps a ReqError by its HTTP status: 404 → not_found, 503 → unavailable, 504 → timeout, 429 → rate_limited. A 403 has no case and falls through to resume_error, which the registry describes as "the resume failed for a different reason. The router has a defect." Every egress policy refusal (destination outside the policy, no policy, actor not running, invalid actor certificate) and every ingress PermissionDenied therefore records ate.router.outcome=resume_error on atenet.router.route.duration, so an alert on router defects fires on ordinary policy decisions and a real resume failure hides among them.

Change

• New ate.router.outcome value denied (ateattr.RouterOutcomeDenied): a 403 ReqError and a PermissionDenied status classify as denied; everything else keeps its outcome, and resume_error is left for a resume that failed for any other reason.
• Registry (docs/metrics/registry/metrics.yaml), the ateattr comment and the outcome list in docs/observability.md list denied. The unavailable outcome no longer names a denied egress request among its examples, since a denial answers 403.

Testing

• metrics_test.go: PermissionDenied, a bare 403 and a 403 wrapping an uncoded cause classify as denied; an uncoded error, an Internal status and a 500 ReqError still classify as resume_error.
• go test ./cmd/atenet/internal/router/extproc/ ./internal/ateattr/, hack/verify/golangci-lint.sh, hack/verify/metrics.sh.

This PR was written by an AI agent on behalf of the author.