[MOR-1628] enforce value-sensitive tuner interlock on direct Web path-3

[morozsm]

Linear: MOR-1628
Parent GitHub: #2541

Parent: MOR-1500
Source authority: origin/main f016380

Outcome
Close the Web handler path that calls set_tuner_status directly and bypasses both the command queue and RadioPoller._execute, while preserving intentional direct CW exemptions.

Owned paths

• src/rigplane/web/handlers/control.py
• tests/test_web_tuner_tx_interlock.py (new focused test)

Red-first witness
A direct-handler test shows set_tuner_status values 1 and 2 reach the radio during known TX without consulting the interlock.

Acceptance criteria

• Tuner value 2 and value 1 BLOCK during known TX and fail closed when RF state is stale/unknown.
• Tuner value 0 is structurally ALWAYS-PASS and always attempts the radio stop/disable operation.
• Rejection, timeout, ignored command, and lack of confirmation remain operator-visible; no false applied result.
• send_cw_text and stop_cw_text retain intentional ungated behavior; stop is always attempted.
• cw_auto_tune remains an RX-assisted frequency correction, not a TX-causing action; its resulting SetFreq is governed at the downstream write seat.
• No unrelated handler routing changes.

Dependencies
Blocked by MOR-1500 A0, A1, and A3. It does not require the deferred lane because tuner enable/start is BLOCK, not DEFER.

Scope guardrails

• Anchor: origin/main f016380.
• Maximum 3 owned files and 400 changed LOC.
• Red-first focused tests; foreground timeout 600000 ms; never run the full suite for this child.
• No refactor, new layer, model-name branch, unrelated cleanup, or scope expansion.
• Public API/CLI/config/rigctld compatibility changes must be called out explicitly.

Project fields
Priority=P1; Risk=high; Size=S; Phase=stable; Owner=codex; WorkType=bug.