`_settable_for` derives the locked bit from unvalidated metadata, so a mistyped `relay-behavior` silently locks the circuit

[dcj]

Follow-up from #50. Robustness and diagnostics, not a regression: no manifest that built and validated cleanly before 0.7.0 behaves differently now.

build_graph runs at emitter.py:121, before ManifestPhysicsView(manifest) at emitter.py:143. wire/graph_builder._settable_for calls manifest_physics.relay_locked, which therefore reads raw metadata no validator has seen, and treats anything other than the literal string controllable as locked:

return md.get("relay-behavior", "controllable") != "controllable" or _opt_bool(md, "always-on", default=False)

Two consequences.

1. An out-of-domain value silently locks the circuit. relay-behavior: CONTROLLABLE, or any typo, yields a circuit with no $settable on switch/relay and no error. Inside Emitter this is masked, because _parse_circuit rejects the value a few lines later. A caller using build_graph standalone gets the silently locked circuit and nothing else. That path is supported and exercised: tests/test_byo_transport.py and tests/wire/* build graphs without a ManifestPhysicsView.

2. always-on is now parsed from a new call site. A malformed value raises ManifestValidationError out of graph construction rather than out of manifest validation. For a manifest with both a missing relay-behavior and a bad always-on, the reported error changes from missing required metadata key 'relay-behavior' to key 'always-on': not a bool.

Either fix works: have relay_locked reject an unknown relay-behavior rather than defaulting it to locked (it already has the valid set next door at manifest_physics.py:135), or hand graph_builder an already-validated bit. The first keeps the "one derivation, two callers" shape the PR was after.

[dcj]

Widened by #57 (0.8.0), not closed. wire/graph_builder._INSTANCE_LOCKS now has a second entry, ("load-shed", "priority") -> never_backup, so there are two lock functions reading raw unvalidated metadata during build_graph, which still runs before ManifestPhysicsView.

The new key also adds a case this issue did not have: build_graph called on its own accepts a manifest that Emitter rejects. never-backup: true with a non-OFF_GRID default-priority raises ManifestValidationError from _parse_circuit, but the graph builder never consults that rule, so it happily omits the $settable and builds a device description for a manifest that can never be constructed into an emitter.

Both halves point at the same fix this issue already proposes: either have the lock predicates reject what they cannot interpret, or hand graph_builder an already-validated answer.