Gate caller-side signal consumers on physt/PhyStsFill (follow-ups from #409)

[josephnef]

PR #409 gave the library layer an honest per-frame PHY-status story: RxAtrib.physt is the raw descriptor bit on every generation that decodes it, the parse outcome is a PhyStsFill tier, and the library-internal EMAs (_rxq, _rxpaths, _cfo) fold only fields the parser actually claims. The caller-side consumers were left for follow-up, and they still ingest the deterministic zeros that physt=0 A-MPDU subframes now carry (pre-#409 those were random stale bytes; post-#409 they are a systematic bias toward zero):

• examples/rx/main.cpp signal consumers are ungated (:911-913 hopset per-slot accumulators, :920-925 g_rxagg energy/LinkHealth aggregate, :1136-1146 DEVOURER_RX_ALLPATHS rx.path rows). Under aggregated traffic the per-dwell RSSI/SNR means scale down with aggregation depth and snr_min pins to 0, so the FHSS exclusion policy scores a better (more-aggregating) channel as worse, DEVOURER_LINKHEALTH classifies a strong link as weak, and all-zero rx.path vectors inflate measured inter-chain correlation toward 1.0 in antenna-decorrelation runs. The gate is now one field read away.
• rx.txhit cannot distinguish "no report" from BCC (examples/rx/main.cpp:1076). ldpc/stbc/bw come only from the PHY-status parse, so a physt=0 subframe deterministically reports ldpc=0/stbc=0 — indistinguishable from a real BCC fallback in encoding-truth-table runs (A-MPDU is opt-in in txdemo, so default regress.py runs are unaffected). Either emit physt in the event or omit ldpc/stbc when there was no report.
• examples/chanscout/main.cpp has the same ungated accumulator shape (:83-110): snr_sum/snr_min fold zeros from frames that carried no SNR, biasing survey records on channels with CCK or aggregated traffic.
• cell::UeRxAttribution folds snr_raw unconditionally (src/cell/UeRxAttribution.h:97): per-UE SNR windows inherit the same zero-dilution RxQualityAccumulator was cured of in rx: gate PHY-status parsing on the RX-descriptor PHYST bit (Jaguar1/2/3) #409 (snr_min pins to 0, means drag down). Same fix shape: per-metric presence counts.

The last two are the same defect class #409 fixed in RxQualityAccumulator (an SNR sum whose zeros are absence, not measurements) — the fix there (snr_valid + per-metric sample counts) is the template.

Validation note for whoever picks this up: the demo-side bias needs aggregated traffic to show (SetAmpduMode on the TX side); a default regress run will not exercise it.