Hub firmware: brain-owned demand mode + symmetric demand on/off proposals (prerequisite for real emit_proposal writes)

Decision 2026-09-06 (docs/DSC-BRAIN.md ‘Hub demand proposals are shadow-mode’): emit_proposal stays shadow. Why real writes are wrong today: the _demand switches are owned by the hub’s Full Auto ladder, which re-asserts them on its next tick (so a brain write is a fight, not control), and the decision loop only proposes demand_on (temp_c_low -> heater_demand, rh_pct_high -> dehumidifier_demand, …) with no demand_off, so real writes would latch appliances on with nothing to release them. What it takes: (1) hub firmware ‘brain-owned demand’ mode – while a brain heartbeat/fresh-command window is valid the ladder yields the _demand switches to native-API writes and takes them back on staleness (same failsafe philosophy as the Sonoff driver); (2) symmetric on/off proposals with hysteresis and min-cycle times in decision_loop; (3) emit_proposal writes via control_ops.call_service_proxy with restore/clear semantics and per-metric owned state; (4) Climate copy switches from ‘brain proposes, hub applies’ to ‘brain drives demand’ only when the mode is active. Until then no SPA surface may describe the brain as driving demand outputs.