MSG-371: harden 3 comparison-consumed env reads missed by MSG-370 sweep (audit BLOCK P2)

audit-general-ca BLOCK on e3cdb01, finding P2. FLEET_PROBE_YELLOW_S/RED_S (hub.mjs:272-273) and ARO_SILENCE_WINDOW_HOURS (:10612) are comparison-consumed, not timer-consumed, and were wrongly classified out of the MSG-370 sweep. NaN at :6706-6711 leaves a host whose transport probe is 5.5h stale reporting GREEN (proven runtime, patched vs pristine control). NaN at :10680 binds as NULL and the ARO silence reaper silently stops kicking. Patch adds envNumAbove() float helper (exclusive lower bound: 0 fails the same way as NaN), moves all three to validated reads, and validates RED >= YELLOW. Diff + rationale: /data-venus/llmmsg-srv/diffs/2026-09-10-msg-371-audit-p2-comparison-consumed.{patch,md}. 71 lines, one file, git apply --check clean against live hub.mjs md5 ecbac6a120919bd5dc11d054663071fe. Audit P1 (malformed interval env = 1ms tight loop, ~50 sites) deliberately NOT in this patch - PM scope call, recommend separate WI.