Shares the router key and pins card-route redrives

[johnnyt]

Works the four points of se-wkmu: a test that a redrive writes nothing back, the status word, one spelling of the router key, and where the routes read the library system.

What changes

• One spelling of the router key. StatifierExamples.RouterKey.join/1 replaces StatifierExamples.FormPost.Sends.key/1 and the doorstep route's private copy of the same code. The card application form's patron system and newsletter routes and the parcel recipe's doorstep route all call it. The function body is the one both copies had, so every stored key is the same string as before; the existing route tests that match the stored key strings stay green.
• A redrive writes nothing back. A new test in routes_test.exs delivers on both routes, plants values on the application row that no route writes (status, both references, updated_at), redrives both deliveries with the same key, and matches the row unchanged. The existing redrive test counted outbox rows only, so it stayed green when a redrive wrote the reference back.
• The status word is documented as the first hand-off. Writer.record_reference/4's doc and the guide's section 5 say sent records that the application was handed on, from the first hand-off; a second route's hand-off writes sent again and moves updated_at, and the two reference columns say which routes it reached. The status values are unchanged, so the host's retention, which keys on sent, is unchanged.
• The library system stays out of the route configuration, and the guide says why. A route's configuration is the map registered beside it in the router's :route_adapters, one value for every execution routed through it, while the library system belongs to each application. The guide's section 5 and both routes' moduledocs say so, and point a multi-tenant host at the execution, as Steps.library_system/0 already does for the steps.

No function answers differently.

Provenance

• The bead offered two routes for the status word (say which hand-offs happened, or document it as the first) and two for the library system (read it from the route configuration, or say why not). This PR documents both instead of changing behaviour: changing the status word would move the retention's sent key, and a per-route library system would be wrong for any host with more than one library system. Decided by the conductor under a standing consent, 2026-10-11.
• The shared key function is a new module, StatifierExamples.RouterKey, rather than one recipe calling into the other's module, so neither recipe depends on the other.

Checks

• Full mix quality green on the committed tree after a rebase onto main.
• Sabotage, each reverted from a copy and the restore checked byte-equal: making Sends.record/5's redrive branch call the writer turned the new redrive test red at the stored row's match; spelling an absent ordinal as the empty string turned the RouterKey test, its doctest and the doorstep route's existing key test red.
• In-turn review: a diff critic and a test critic over the branch. Accepted: the guide had credited the steps' documentation with the route-configuration half of a sentence; it now credits only what that documentation says.
• No record text in this PR.