feat: add the {SCOPE}__CIRCUIT_OPEN admission policy key

Limiter rejections have always chosen between waiting and failing fast;
breaker rejections had no such choice. The new key is the missing cell
of that matrix, shaped exactly like QUOTA_FULL so there is nothing new
to learn. It defaults to fail_fast: flipping the default would move
every existing deployment's worst-case wall clock from milliseconds to
the stall window, which is the wrong direction to impose on anyone.
Single-source scopes are the ones that want wait, and they now have a
way to say so.

The two keys stay separate despite sharing a domain, because a full
quota is "queue for your share" (your turn always comes) while an open
circuit is "wait for the source to recover" (it might not).

Policy validation collapses into SourceAdmission, the only consumer.
The three client constructors used to each carry their own copy of the
quota_full check; adding a second key there would have made eight
copies of the same two lines. Rejection timing and message are
unchanged -- admission is built inside those constructors.

This commit only wires the key through; the control flow that reads it
lands next.

tests/unit/test_config.py

@@ -170,6 +170,20 @@ class TestResilienceKeys:
         with pytest.raises(ValueError, match="probe"):
             GatewaySettings.from_env("LLM", env=_env(**{"LLM__BREAKER__PROBE_TTL_S": "45"}))
 
+    def test_circuit_open_defaults_to_fail_fast(self):
+        """issue #14: 熔断拒绝的处置策略。
+
+        缺省**不跟随** quota_full 的 wait——把最坏墙钟从毫秒抬到 stall 窗口
+        是"快速失败 → 长时间挂起"这个最危险的方向,不能强加给存量下游。
+        """
+        assert GatewaySettings.from_env("LLM", env=_env()).circuit_open == "fail_fast"
+        waiting = GatewaySettings.from_env(
+            "LLM", env=_env(**{"LLM__CIRCUIT_OPEN": "wait"})
+        )
+        assert waiting.circuit_open == "wait"
+        with pytest.raises(ValueError, match="CIRCUIT_OPEN"):
+            GatewaySettings.from_env("LLM", env=_env(**{"LLM__CIRCUIT_OPEN": "block"}))
+
     def test_selector_and_quota_full(self):
         # M2.5: 缺省选源改 health_aware(生产级默认);显式配置者不变
         s = GatewaySettings.from_env("LLM", env=_env())
@@ -589,6 +603,7 @@ class TestCrossFieldInvariants:
             ("telemetry_backend", "redis"),
             ("selector", "random"),
             ("quota_full", "block"),
+            ("circuit_open", "block"),
         ],
     )
     def test_enum_field_rejects_value_outside_domain(self, field, bad_value):