fix(gate): web-app keypool leg opts into WO_EPHEMERAL=1 — refused since databasev2 2 task 6a

- the leg copies the porch package, whose store declares RateLimitCounter
  default-durable, and ran the check program with no WO_DATA: since 6a that
  is a startup refusal, so `just web-app` read 56 checks, 1 failure on dev
  and on master alike — the 6a blast-radius pass missed this leg
- RAM-only opt-in on that one run, boot notice filtered from the byte-exact
  compare (the db-actor / wmux pattern); web-app 56/0

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
(cherry picked from commit 1ce195da25f527eb1fed3e9e6b8843e00315f25e)

scripts/web-app-accept.sh

@@ -512,7 +512,9 @@ fn main() -> Int {
 WOEOF
 if kp_out="$("$WOC" --emit "$KP" -o "$KP/kptest.wob" 2>&1)"; then
   kp_before_ms="$(date +%s%3N)"
-  kp_vm="$("$WOVM" "$KP/kptest.wob" 2>&1)"
+  # databasev2 2 (6a): the copied porch package declares RateLimitCounter
+  # default-durable, so this RAM-only run must opt in or it refuses at boot
+  kp_vm="$(WO_EPHEMERAL=1 "$WOVM" "$KP/kptest.wob" 2>&1 | grep -v '^wovm: WO_EPHEMERAL=1')"
   kp_after_ms="$(date +%s%3N)"
   read -r kp_c1 kp_c2 kp_reset <<<"$kp_vm"
   # v1 is the FIRST-ever hit for this key — the "fresh window" path