Make aggregate ONNX gates execute for real

Reference-count the process-global ONNX Runtime across embedder and routing-head sessions, make close idempotent, and require named proof that both aggregate routing gates executed rather than self-skipped (V-716). Owner explicitly requested direct commits to master.

internal/router/eval/eval_test.go

@@ -197,6 +197,7 @@ func TestONNXBaseline(t *testing.T) {
 		t.Skipf("onnx embedder unavailable: %v", err)
 	}
 	defer emb.Close()
+	recordONNXGateExecuted(t)
 
 	f, err := Load()
 	if err != nil {