Apply calibration results as a signed host action — kill the last copy-paste

## Why (bench evidence, 2026-08-14)
The car calibration screen (app build 44+) ends the steering-trim flow with a copyable STEERING_NEUTRAL_US block the operator must SSH-paste into gateway-policy.env. It is the last terminal moment in the drive flow. The host-config rail (commission tier, signed host.* actions, operator-gated) exists precisely for this shape of change.

## What
- A commission-tier host action (e.g. host.drive.trim) that writes the measured OPENCASTOR_DRIVE_*_NEUTRAL_US / span values into gateway-policy.env and restarts the gateway — signed, receipted, allowlisted like every host.* tool
- App: "Apply to robot" button on the calibration results section, drafting that action for the operator to sign; the copy block stays as fallback
- Guard: the action may only touch the OPENCASTOR_DRIVE_* trim keys — never OPENCASTOR_DRIVE itself (sim→real stays a deliberate operator flip, per the safe-by-default rule in castor up)

## Acceptance
- Calibrate → Apply → sign → gateway restarts → status.report telemetry reflects the new neutral; receipt in the ledger
- The action REFUSES to write any non-trim key (test)

## Pointers
- host-actuator deploy/ (existing sudoers/helper rail); capabilities_api policy-write precedent (it already rewrites gateway-policy.env + restarts)
- Measured trims live phone-side in VehicleProfile (steeringTrim, measuredCreepThreshold)

Start with host-actuator deploy/ and the capabilities_api policy-write precedent, then trace how measured trims move from VehicleProfile into the host-config rail. Define the signed, receipted commission action and its allowlist before connecting the calibration results button. Done means Apply → sign updates only trim keys, restarts the gateway, and produces updated status.report telemetry and a ledger receipt.

Written by the indexing model from the issue text.