feat(kv): read bounded authoritative snapshots after a leader barrier

[wolfy-j]

Follower-local KV snapshots can lag an accepted leader write. This PR adds AuthoritySnapshotReader to the Raft-backed KV engine: a leader barriers Raft, then returns selected keys (including authoritative absence) from one detached KV publication; followers forward through the existing relay instead of substituting local state.

Requests and replies use one versioned wire format with bounded envelopes (up to 256 keys and 64 KiB per reply), canonical key ordering, and strict decoding. Up to 32 authority operations are admitted concurrently. Correlation uses connection-derived ingress identity. Caller cancellation removes pending waiters; if a Raft barrier cannot be canceled, its permit remains held until the future finishes. Leadership and transport failures are operational errors, including a retryable unavailable result when no leader can be resolved.

This is an infrastructure API only. It does not activate Strong naming, change admission policy, or add workspace behavior. The three-node tests exercise real Raft with an in-process relay and synthetic ingress, not production internode/TLS.

Validation on current main: go test -race ./system/kv/... ./cluster/clustertest/... -count=1, go vet ./system/kv/... ./cluster/clustertest/..., and git diff --check. A GOARCH=386 package test remains blocked by the unchanged system/crdt/delta.go constant-overflow build error; wire lengths are checked before conversion to int.

[wolfy-j]

Batch architecture review: inspected the codec, admission, cancellation, ingress binding and forwarding paths; focused authority/relay race tests pass. No production caller of ReadAuthoritySnapshot exists in this PR: only the interface, implementation and tests. Under the current requirement to avoid unused runtime vocabulary, hold this protocol/API until a concrete consumer and its consistency contract land together. Also the description says 32 keys while maxAuthoritySnapshotKeys is 256; maxAuthorityConcurrent is 32. Current main now has LocalSnapshotReader in api/store/kv/snapshot.go, so integrate deliberately rather than replacing that file.