refuseDispatchPath

Veto, run last on what would actually be woven. All or nothing, since a name-only install weaves every overload — so the survivors are listed, which turns the refusal into a narrower retry rather than a dead end. Built here rather than in PatchDiagnostics: one call site, and refusal's reasons already are the diagnosis.