nats: a warrant's spend record in the keeper's own state spent; the fill pass while the consumer binds; partial says kept

Review round 2 of the registry milestone:
- security F2: the spend record leaves requests, which the tools write as the tool runner's account, for state spent,
  named in the keeper's bus.state and declared read-only (the lead's 18:1x ruling: the tools read it, never write);
  nats_requests lists the warrants spent from it;
- running F1: the fill pass also runs while the manifest-accepted consumer is bound again;
- health note 3: an event said on the seat's subject and refused by its history is kept with its one id and said again
  on the history alone, never again with a new id;
- seams note 3, health note 4: words unsaid with a status that cannot be written raise the keeper's own condition
  status-unwritten, cleared when it is written; the health names what a restart would lose.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/nats/module.json

@@ -89,6 +89,12 @@
       "name": "requests",
       "history": 5,
       "ttl-seconds": 86400
+    },
+    {
+      "name": "spent",
+      "history": 1,
+      "ttl-seconds": 86400,
+      "read-only": true
     }
   ],
   "listens": [
@@ -245,7 +251,8 @@
       "bus": {
         "state": [
           "asked",
-          "requests"
+          "requests",
+          "spent"
         ],
         "asks": true,
         "keeps": true,