### The C settlement kernel signs no grade its meter cannot support

- **`oer-conformance/settle/`**: `settle_decide` refuses (returns -3, before any record or the
  chain changes) a meter whose grade or weakest input's grade is not one of oer-receipts §2's
  four, or which grades a figure `measured` by a method other than `hardware_meter`, the corpus's
  term for a meter that reads an instrument. The kernel already wrote the grade its meter states;
  it now cannot be handed a model's figure graded as a reading and sign it.
- The host harness checks three such refusals and that a `measured` figure from `hardware_meter`
  is taken, after writing its file, and exits 4 if any check fails, so the CI step that rebuilds
  `firmware_vectors.json` checks the rule on every unix leg. The corpus is unchanged, byte for
  byte.
- **Breaking:** `record:corpus:wai/oer-conformance/settle/settle.c`: the kernel's source is in
  the corpus's directory, and `settle_decide` now returns -3 for a meter it used to sign. No
  vector changes: `firmware_vectors.json` is the same bytes, and every receipt a verifier reads
  is as before. A caller that passed a meter graded `measured` by a method other than
  `hardware_meter`, or a grade outside the four, grades its figure as what it is (`projected`,
  `simulated` or `derived`), or names the meter that reads an instrument.
- **Breaking:** `record:corpus:wai/oer-conformance/settle/settle.h`: the header states the -3
  return beside the meter's grade; no type or signature changes.
- **Breaking:** `record:corpus:wai/oer-conformance/settle/host_main.c`: the harness writes the
  same file, then checks the refusals and exits 4 where the kernel signs a grade its meter
  cannot support; a script that runs it reads exit 0 as before.