S13 collection mode Step 3: the health gate marks instead of excluding

Step 3 of the shared internal/virtual collection mode. The plan is docs/plans/2026-09-04-virtual-collection-mode.md, section ### Step 3: the health gate marks instead of excluding, which carries the full scope, files, acceptance criteria and testing notes. Read it rather than this summary before starting.

Scope: loadAndFilter gains a health-gate mode: the winner path keeps today's exclusion, and a collection gets the position marked unhealthy, eligible for a cache read and barred from an upstream request. It also records each excluded position's Reason, because the collection's record set has to tell a policy denial from a data error and today's state keeps neither.

Files:

• internal/virtual/resolve.go (Modify): an unexported healthGate mode.
• internal/virtual/decision.go (Modify): the failed const doc.
• internal/remote/audit.go (Modify): the UpstreamExclusionAuditSink doc.

Depends on: nothing. This is the only step with no dependency of its own, so it can open first once the plan merges. Its order against S32's Step 10a is "either, and whichever lands second rebases".

Type: feat. The MR title ends with (S13 collection mode plan: 3/6).

Related to #1243 (closed).