feat(pcb): add KiCad 10 native Specctra bridge

[neusse]

Closes #341.

What this adds

This is the KiCad 10 native-export fast path for the Freerouting stack in #338, #339, and #340. Konnect can ask its existing ActionPlugin to call KiCad's native pcbnew.ExportSpecctraDSN, without GUI automation and without replacing the Rust/IPC architecture.

• authenticated, ephemeral IPv4-loopback bridge with one narrowly scoped export operation
• native exporter marshalled onto KiCad's wx UI thread
• plugin-owned temporary paths, removed after Rust consumes the DSN
• native output bound to the exact IPC snapshot before and after the call
• semantic validation of components, placement, pads, nets, layers, classes, clearance, width, and vias before adopting native identifiers into the reverse manifest
• strict Rust SES planning and atomic IPC application remain unchanged
• native_bridge_mode: prefer | require | disable; prefer safely falls back to the Rust exporter
• only an enable checkbox and read-only status are added to existing plugin settings
• PCM packaging and validation cover the bridge module

This does not fold in existing CLI, database, logging, transport, or IPC-socket settings. Per-user CLI discovery remains #254. Replacing the legacy SWIG plugin for KiCad 11 remains #257.

Release 10 revalidation

Konnect v0.10.0 landed after this stacked PR was opened and created blind-side breaking changes in the lower routing stack and its public contracts. The branch is now based on the fully revalidated #338/#339/#340 heads and current upstream. The input and response consistently use native_bridge_mode, backed by a closed enum rather than an untyped free-form string.

The v0.10 catalogue remains 218 registered / 224 total tools because this layer changes an existing tool rather than adding one.

Evidence

• Specctra/native-bridge Rust tests: 20 passed, 2 live-Java tests ignored by default
• cargo test -p konnect --locked: passed, including registry, docs, schema, and protocol guards
• KiCad Python plugin tests: 8 passed
• PCM metadata validation: passed
• Real Freerouting 2.3.0 route of the KiCad 10 native golden DSN: passed
• Post-test process inspection: no Freerouting Java process remained

Stack

1. feat(pcb): export revision-bound Specctra DSN #338 — revision-bound DSN export
2. feat(pcb): import Freerouting SES atomically #339 — strict/atomic SES import
3. feat(integration): route DSN through Freerouting MCP #340 — Freerouting native MCP orchestration
4. this PR — optional KiCad 10 native DSN bridge

[neusse]

Release 10 blind-side revalidation note: v0.10.0 changed the lower routing stack and public contract after this PR was opened. I rebased this layer onto the repaired current heads of #338, #339, and #340 plus current upstream, then reran the Rust, Python-plugin, PCM, and real Freerouting route evidence.

The public contract is now consistent: both input and response use native_bridge_mode, constrained to prefer | require | disable. Current head: fb3a6c8.

[neusse]

Restacked on the updated #340 head after the #362-#365 guidance/hook block. The merge was automatic and preserved the native KiCad 10 Specctra bridge unchanged. The complete local gate passes. Updated head: 39d818d.