Story: Clean ores.nats to the component clean standard

ores.nats meets the Component Clean Standard: the items marked All pass, each item that does not apply is recorded with its reason, and ores.nats joins COMPONENTS_UNDER_TEST. Order 9 of 35 in the sprint 26 component clean-up, tier 1 (foundation infrastructure).

• Every checklist item that applies to a component of kind All passes, with its evidence recorded on the task.
• Every item that does not apply is recorded as not applicable, with the reason.
• Every generator defect found is fixed at its source, with a regression test.
• ores.nats is listed in COMPONENTS_UNDER_TEST, and check_component_drift.py --all passes.
• V06 states why the first half of that criterion cannot hold: the registry admits only model-bearing catalogue entries. The experiment that listed nats anyway is kept as evidence, and check_component_drift.py --all passes without the entry.

• Survey on 2026-09-23: 0 entity, junction or operation models; 33 C++ files outside tests, 0 of them generated (0%); 0 messaging headers, 0 of them hand-written.
• The JWKS signing-key subject is a string literal here, because ores.nats cannot depend on ores.iam for the constant. Record it as a P02 layering exception, or give the constant a neutral owner.

• A component with no models cannot join COMPONENTS_UNDER_TEST. The registry resolves its members through the codegen catalogue, and this component has no catalogue row, so the gate answers "unknown component". V06 is recorded as not applicable with that reason, the same way ores.database and the four surveyed infrastructure components record it. The registry's model-bearing-only admission is the standard's own recorded finding.
• Delete code with no consumer. B06's census found the whole JetStream read and message surface, three domain types, two client verbs and the free as_string_view helper with no caller in the tree, and they are gone.
• The namespace documentation header is not dead code. The census listed ores.nats.hpp with no consumer, and G08 exempts it by name: its content is an empty namespace, so nothing includes it and nothing should. It is kept, and the stale claims inside it are corrected in place.
• Fix a generator before refreshing what it generates. The diagram generator dropped every class whose declaration carries an attribute before its export macro, so this component's diagram was missing two classes. Fixed at source with a regression test, and only then refreshed.
• An automated diagram pass is a skeleton. The manual pass below the sentinel is what makes the boxes carry their API and the relationships appear, and the rendered image must be read before the diagram is called done.
• The wire format is a startup decision. The component's own overview claimed every payload was JSON; the codec is fixed once from ORES_NATS_WIRE_FORMAT and defaults to msgpack.

• The subject namespace a caller chooses is the caller's model. This component moves bytes and applies the prefix; it owns no subject.