Type ColdRefused as a sum over the startup reasons

[blooop]

Question

Type ColdRefused as decided in "Make api::Launch self-sufficient and type ColdRefused": replace reason: String (flows/launch.rs:1880-1884) with a sum over the startup reasons — NoHomeDirectory / Config(ConfigError) / Metadata(MetadataError) (payloads already core types, mirroring dl's private StartupError at dl/src/session.rs:35-39) — plus a no-cold-path arm replacing NoColdPath's English literal (flows/launch.rs:1911-1916). dl's renderer takes over the words (render.rs:2034-2046 currently clones the string; render::startup_reason becomes the match on the typed arms). Consult constructive-modeling; follow the NotRefreshed precedent (repo_manager.rs:336-359). Red-first: a test pinning that a metadata-refused cold open surfaces as the typed arm, not prose.

[blooop]

Claimed 2026-08-29: queued in the session working map #299's build tickets (waves behind #340/#349's PRs so the api surface and shared JSON writer move once). Build to follow from an opus agent in an isolated worktree. If you are another session seeing this, do not double-build.

[blooop]

breadcrumb: the red test this ticket names now exists, in PR #514, which is where the typing landed as a prerequisite for #340.

The shape went in with the move: ColdRefused is Startup(StartupError) or NoColdPath, and dl's render::startup_reason is the match on the arms. One deviation from the letter of this ticket, and it is deliberate: #340 moved the records plumbing into core, so StartupError is a real core type now rather than the private one in dl/src/session.rs this ticket asked to mirror. The sum reuses it instead of restating it, which covers the same four outcomes and cannot drift from the type it was mirroring.

That much was there in the first commit. What was not, and what the fresh-context review caught, is this ticket's own red: nothing in the tree constructed ColdRefused::Startup or StartupError::Metadata at all, so "the reason travels as a type" was inspection-only. Three tests now:

• flows::launch::tests::a_metadata_refused_cold_open_surfaces_as_the_typed_arm drives name_default_branch with a cold path that refuses the way the real one does, and asserts the whole refusal, BranchNotNamed::Cold(ColdRefused::Startup(StartupError::Metadata(..))), with the MetadataError intact. Siblings pin prepare's NotPrepared::Cold (two separate map_errs over one open) and NoColdPath, the arm that replaced core's English literal.
• Proven red rather than assumed: flattening the arm back to Startup(String) filled with format!("{refused:?}") breaks all three at compile time.
• render::tests holds the byte-identity half, every arm against its whole sentence, plus the composition into Repository 'owner/repo': <reason>.
• test/unit/test_cold_path_refusal.py runs ColdPath::open's Err arm for real, which is the only way to run it: the open resolves its paths from the process environment, so nothing inside either crate reaches it without mutating an environment every other test shares.

The PR carries Closes #339 alongside Closes #340. Not merged; merge stays human.