pub fn flag_to_metric(flag: u64) -> &'static str
Decode the shared violation flag into the metric label the tunnel spawner records (DP-05, #253). Returns an empty string when no violation occurred.