sweep claim, decision, netscan and vision (V-581)

The decision ring kept evicted turn records reachable. Push resliced the
backing array forward without clearing the dropped pointers, so up to
ringSize records stayed addressable until the next append reallocated. The
package holds this store in memory precisely so his words do not outlive the
diagnosis, and the reslice quietly broke that. Push now nils the dropped
slots first.

internal/claim carried three drifted counts in its package doc. The cascade
has twenty-two stage-0 grammars and not ten, and seven stateful pre-emptors
and not four. The band ordering itself did not drift: bandOf still maps stage
0 to anchored, the LLM router to structural and the classifier to nearest,
which is the order buildRouter and querySources actually run in.
BandStructural now names preRouteLadder as the roster so the next count is
checkable rather than remembered.

netscan formatted a port with fmt.Sprintf once per probe. A default scan is
1016 probes, so strconv.Itoa is the same string for less work, and the local
itoa helper goes with it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/netscan/netscan.go

@@ -33,6 +33,7 @@ import (
 	"net/netip"
 	"os"
 	"sort"
+	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -323,7 +324,7 @@ scan:
 			go func(addr string, port int) {
 				defer wg.Done()
 				defer func() { <-sem }()
-				if s.dial(ctx, net.JoinHostPort(addr, itoa(port)), s.cfg.Timeout) {
+				if s.dial(ctx, net.JoinHostPort(addr, strconv.Itoa(port)), s.cfg.Timeout) {
 					results <- result{addr: addr, ports: []int{port}}
 				}
 			}(addr, port)
@@ -371,8 +372,6 @@ scan:
 	return Result{Hosts: out, Truncated: truncated}, nil
 }
 
-func itoa(n int) string { return fmt.Sprintf("%d", n) }
-
 func dialTCP(ctx context.Context, addr string, timeout time.Duration) bool {
 	d := net.Dialer{Timeout: timeout}
 	ctx, cancel := context.WithTimeout(ctx, timeout)