fix: close Freerouting bridge acceptance gaps

[neusse]

Closes #337

Summary

This is the terminal closeout for the merged Freerouting bridge series (#338, #339, #340) and the optional KiCad 10 native-export bridge (#342).

• report engine_found, native_mcp_available, and bridge_available as separate observed readiness boundaries;
• force the owned unauthenticated Freerouting API/MCP endpoints to loopback and close/reap the Java child on success, failure, timeout, cancellation, and initialization failure;
• preserve locked straight tracks and through vias as Specctra type fix, while continuing to refuse unlocked routing, routed arcs, zones, and unsupported geometry before mutation;
• keep the Rust/IPC DSN exporter as the default, with the Python/SWIG KiCad 10 bridge available only through explicit prefer or require opt-in;
• accept Freerouting native-MCP transport details that were observed end to end: job-ID base_design aliases and vias whose net is inherited from their validated enclosing network_out/net;
• validate every created route item and retain its KiCad-assigned KIID for exact failure compensation;
• add real KiCad 10.0.5 / Freerouting 2.3.0 locked-routing DSN, SES, and arc-refusal fixtures; and
• document the workflow, compatibility change, lifecycle behavior, and live undo acceptance gate.

KiCad 10 transaction boundary

Live testing found that KiCad 10 publishes neither GetItems nor SaveDocumentToString changes while a commit is open. The import therefore keeps all pre-mutation validation and per-item result/KIID checking inside the single named commit, ends that commit, and then performs exact IPC read-back, candidate serialization, and direct KiCad DRC.

If a post-commit evidence step fails, Konnect deletes only the KIIDs returned by CreateItems in a compensating transaction and verifies that the exact pre-import serialization returned. The successful path is still one Import Freerouting SES undo step. The source board file is never overwritten; DRC findings and remaining unrouted items are reported as evidence instead of being hidden or reclassified as transport failure.

Compatibility

export_specctra_dsn.native_bridge_mode now defaults from prefer to disable. This reconciles #342 with #337's Rust-only default contract. KiCad 10 users can still opt into the authenticated native bridge with prefer or require. The migration is recorded in docs/API_MIGRATIONS.md.

Evidence

Required workspace gate:

• cargo fmt --all -- --check
• cargo clippy --workspace --locked --all-targets -- -D warnings
• cargo test --workspace --locked --lib --tests
• cargo test --workspace --locked --doc

Installed Freerouting 2.3.0 / Java tests also passed for readiness probing, native-MCP routing, overall-timeout cleanup, task-cancellation reaping, Rust-export routing, and native-KiCad-export round trip. No Freerouting Java process remained afterward.

The manual real-KiCad gate routed the disposable locked fixture to 13 segments / 2 vias, then one Ctrl+Z restored the original 1 locked segment / 1 locked via and the exact pre-import IPC serialization. Runtime implementation remains IPC-only; computer interaction was used solely to provide the one UI undo action that KiCad IPC does not expose.