Outside services read answers redacted and whole; a card's own lanes

From the second review.
- An output service reads the answer with the values restore put back
  taken out again (guard.Subject.Restored), as an input service reads the
  request redacted.
- With n above 1, the service reads the first choice once it is whole,
  not at whichever choice finished first.
- Restored values go into an answer asked for as JSON (response_format)
  escaped for it, as into tool-call arguments.
- The embedding failure is logged once a minute through an outage, not
  once.
- A card's own lane count and fastest generation come from the kernel
  (max_link_width, max_link_speed): the driver's width.max is what card
  and slot allow together, so an x16 card in an x8 slot read x8 of x8 and
  was never said.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -113,7 +113,8 @@ APIs change between minors without a deprecation period.
 
 - **A card in the wrong PCIe slot is said so.** Each agent reads how every
   card is linked — the fastest generation card and slot allow together, and
-  the lanes in use — against the card's own most; a card on fewer lanes or
+  the lanes in use — against the card's own most, from the kernel (the
+  driver's figure is what card and slot allow together); a card on fewer lanes or
   an older generation is a node warning, with what it carries and what it
   could, on the dashboard, the console and in `llmgw doctor`.
 - **And on a web page, `/admin/mcp`.** For administrators: the same list,