Scoping your planes no longer opts you out of the door

PROXIMO_SURFACES chose the doorway as well as the planes. Setting it kept the pre-0.30
catalog door, so an install that scoped itself never got the 0.30.0 default it thought it had:
on a PVE+PBS box, 569 resident tools where the facade serves 5. Removing a
PROXIMO_TOOLSETS=catalog pin to "adopt the new default" bought two tools (571 → 569).

It failed silently. A working server, the old bill, no warning.

Surfaces now scope the searchable catalog and leave the door at the default facade.
Nothing becomes unreachable — a 800-combination matrix against 0.30.0 confirms zero
reachability regressions — and the old doors are one named variable away:
PROXIMO_TOOLSETS=catalog (full schemas, auto-scoped) or =all (everything).

Found by an external security and behaviour re-vet that probed the running server over stdio
JSON-RPC instead of trusting the changelog. Our own suite could not have caught it: the test
guarding the exact README sentence that was wrong validates the scoping filter, not what a
client is actually served.

Also fixed

• proximo doctor no longer names a tool the box does not serve. It derived the facade
  size and "memory-first" from an environment variable while scoping had pruned
  proximo_recall, and pointed a model at it. Both now read from the live registry. It also
  credited PROXIMO_SURFACES for narrowing that autoscope actually did, including reporting
  "NOT plane-narrowed" on a box where hundreds of tools had been pruned.
• A utility-only surface is served plainly. PROXIMO_SURFACES=memory built a search facade
  over a five-tool world while telling the model ~900 were searchable. That description now
  counts this server.
• A second scoping pass no longer collapses the searchable catalog (measured 314 → 4).
  Pre-existing in 0.30.0, embedder-facing only; every shipped entry point scopes once.
• Estate memory announces its file on every start, with the path, the opt-out
  (PROXIMO_MEMORY=0) and the relocation (PROXIMO_MEMORY_PATH) on the same line. It stays on
  by default; the objection worth honoring was that a plaintext inventory of your guests, nodes
  and targets should not appear unannounced.

Corrections to what we published

SECURITY.md said PROXIMO_SURFACES=all "forces the full surface" — it does not.
docs/SETUP.md priced SURFACES=pve at ~97,432 tokens for "a whole plane (311 tools)"; it is
the facade at a measured ~868 tokens with 312 searchable, and the 311 was wrong before this
release too. The README briefly claimed 316 tools "reachable, and only those", which was false
in the other direction: scoping changes what is advertised, never what is reachable by name.

Upgrading

If you set PROXIMO_SURFACES, your advertised tool count will drop sharply and everything
stays callable. To keep the memory-first estate answer resident, name it:
PROXIMO_SURFACES=pve,pbs,memory. To keep the old door, PROXIMO_TOOLSETS=catalog.

Full detail, including the claims corrected rather than rewritten away, in
CHANGELOG.md.