Cross-domain verification: separate "couldn't check" from "not vouched", and report what the permissive gate excludes #1883

Problem

verify_cross_domain_properties and the permissive domain gate (#1711, released in the 10.0 betas) treat "couldn't check" the same as "the publisher said no", and the gate can't say what it excluded. A sales agent that marks unconfirmed properties instead of dropping them, which is what you want while publishers are still onboarding, can't tell these cases apart.

We ran 10.0 (e3e5f240) read-only against a production sales agent's stored catalog: 202 publisher domains across 31 sellers. One network adagents.json names about 6,750 other publishers' sites.

• max_domains (50) cut the check short, so 6,749 of those sites came back in unverified with reason domain_limit. Of the sites that were checked, 49 verified and 2 were fetch_failed. A caller that treats unverified as "drop" (the docstring calls it "cross-domain claims to drop") removes almost the whole network's inventory, even though nearly every site it checked was vouched for.
• No property was lost to the gate in that run. But the gate's design means a loss would be silent: there is no way to see what it removed.

Requests

1. Separate "couldn't check" from "no". Put domain_limit and fetch_failed in their own list (for example CrossDomainVerification.undetermined), or add a flag the caller can test. Keep unverified for not_vouched and invalid_domain, where a file loaded and didn't authorize the claim. Then a caller can retry the undetermined claims later instead of acting on them.
2. Neutral docstring wording. unverified should say "claims the named publisher did not vouch for, with the reason", not "claims to drop". The API already leaves the decision to the caller.
3. Let callers see what the permissive gate excludes. Either document allow_any_domain=True followed by properties_for_publisher_domain(..., include_domainless=True) and verify_cross_domain_properties(...) as a supported production path (today the docstring says "use it only for diagnostics"), or have the gated resolve also return the excluded properties, each with a reason.
4. The gate drops a publisher's site that is listed with its app. _only_names_domain rejects a property whose identifiers are a domain under D plus a bundle ID. That is the publisher's own inventory; the bundle ID is just something a domain can't vouch for. Dropping it loses the site too. Suggest keeping the property and treating the non-domain identifier as undetermined.
5. Guidance for large network files. Documenting the expected pattern would help every implementation: verify outside the sync, cache by domain across callers, pass a budget through max_domains, and treat domain_limit as "not yet". A helper that chunks a large claim list across calls would also help.

Strict mode, typed selectors, revocations and agent matching should stay exactly as they are.

Follow-up to #1697 / #1711.