feat(pcb): import Freerouting SES atomically

[neusse]

Summary

Adds the strict, non-destructive return path for the Specctra routing bridge proposed in #337.

This is PR 2 of 3 and is stacked on draft PR #338. Until #338 merges, GitHub will show its two DSN-export commits in this PR as well; the new SES-import commit is ad2c319.

User-visible behavior

• plan_specctra_ses_import fully validates an SES against the reverse manifest and exact live KiCad snapshot, then returns every proposed track and via without mutation.
• apply_specctra_ses revalidates the same provenance, requires exactly one PCB open, builds every protobuf item before mutation, and creates the route in one KiCad undo transaction.
• The source board is never saved over. Apply creates a new candidate .kicad_pcb with create-new atomic semantics.
• KiCad IPC read-back must exactly match the planned track/via counts.
• KiCad DRC runs against the candidate before the undo transaction is committed. Any normal or schematic-parity violation rolls the transaction back; remaining unconnected items are reported as incomplete routing evidence.

Strict first-profile refusals

The importer rejects:

• stale or wrong-board manifests
• unsupported manifest schema/profile
• any component placement, rotation, side, or image change
• unknown or repeated SES fields, nets, layers, padstacks, segments, or vias
• arcs/qarcs and other unsupported route syntax
• malformed/non-finite/out-of-range coordinates and zero-length or duplicate segments
• via geometry that differs from the exported rules
• a live board that gained routing after export
• multiple open PCB documents during the global KiCad undo commit
• existing candidate or DRC output paths

Evidence

Exact repository gates passed:

• cargo test --workspace --locked --lib --tests
• cargo test --workspace --locked --doc
• cargo clippy --workspace --locked --all-targets -- -D warnings
• cargo fmt --all -- --check

Additional engine parity passed locally with Freerouting 2.3.0:

FREEROUTING_JAR=... cargo test -p konnect-core freerouting_accepts_exported_fixture -- --ignored --nocapture

That test now exports the KiCad 10.0.5 fixture, runs the real Freerouting engine, reads its actual SES output, and passes it through the strict Konnect import planner.

Risk and rollback

The source file is preserved, the candidate path is create-new only, and all live route creation is one named KiCad undo step (Import Freerouting SES). Any parse, IPC, read-back, candidate-write, DRC, or commit failure drops the transaction and removes newly-created candidate evidence.

Part of #337.