Simulate fallbacks, correlation and budgets

The simulation has three small models and one policy. Outages are sampled per minute with a shared "both down" event, request latencies are lognormal per route, and budgets are a discrete-event loop where spend lands when a request completes. The gateway policy is a plain function of those: budget check at the start, then each route in order with a timeout. The decision that matters most is how correlated outages are sampled, because the obvious way silently changes each provider's availability and makes every later number wrong.