release: under the CRUX policy the T-1 dogfood ladder gate runs before the models lane has written its receipts #4930

Under the standing CRUX-smoke release policy, scripts/release/autopilot.sh starts the T-1 dogfood lane at the same time as the models lane. The dogfood runs scripts/check_model_ladder.sh (a declared dogfood gate in Cargo.toml) with no CRUX receipt directory, while the models lane is still writing those receipts to $AP/models-t1. The gate reads red, so an unattended pass cannot get past T-1 for a version the policy covers.

Fix (P7 WIRE):

• Under the policy, the join holds the dogfood lane until the models lane exits GO, then starts it with MODEL_LADDER_CRUX_DIR=$AP/models-t1 and CRUX_CERT=<release worktree>/evidence/crux/<V>/prompt-certification.json.
• A red in models, or in any lane before models ends, means dogfood never starts; its row reads NOT-RUN.
• deep still starts at once. Without the policy, nothing changes.

Proof: scripts/check_release_t1_lanes_joined.sh gains four policy cases and the mutants that break them. The cases fail on main and pass with the fix.

Refs E1 #3998