Pre-mainnet gates (M3 + M4 + p3)

Closes the pre-mainnet gates from docs/aigarthpool/audit-checklist.md that don't require external coordination. M3 (rate limits) and M4 (circuit breaker) are the cheapest of the M-bucket items; p3 (Qearn watcher + stake-attribution audit) is the post-mainnet watcher that proves the off-chain mirror stays in sync. M5 (migration plan) and M6 (insurance fund) are operational/financial and stay in the tracker as next steps. Testnet deploy (20.6) and audits (I1–I4, E1–E3) are out of scope here — they wait on the AIO Dev Kit and reviewer time. ~3 tasks, ~6 SP.