[MOR-1629] enforce TX interlock across rigctld direct-write paths

[morozsm]

Linear: MOR-1629
Parent GitHub: #2541

Parent: MOR-1500
Source authority: origin/main f016380

Outcome
Add the shared enforcement seat to rigctld CommandService execution so direct frequency/mode/VFO/split/RIT-XIT/raw/tuner and routed writes cannot bypass MOR-1500.

Owned paths

• src/rigplane/rigctld/handler.py
• tests/test_rigctld_tx_interlock.py (new focused test)

Red-first witness
Focused rigctld tests show set_freq, set_mode, set_vfo, set_split_vfo, shared RIT/XIT offset, tuner enable, and send_raw execute during known TX without the ruled disposition.

Acceptance criteria

• All material rigctld set paths map to the shared command-family policy before radio calls; raw send is hard BLOCK and cannot bypass.
• PTT OFF and equivalent typed stop/off operations always attempt; PTT ON is a hard RF-start operation under unknown/stale state.
• DEFER uses the single-slot 3.0-second lane and 1.0-second known-RX quiet window across concurrent sessions.
• BLOCK, expiry, supersession, transport rejection, and timeout map to truthful existing Hamlib errors and CommandService terminal lifecycle outcomes; never RPRT 0 for a command not attempted/applied.
• Existing rigctld wire command names and response framing remain compatible.
• No write path is moved into routing.py and no second policy table is invented.

Dependencies
Blocked by MOR-1500 A1, A2, and A3.

Scope guardrails

• Anchor: origin/main f016380.
• Maximum 3 owned files and 400 changed LOC.
• Red-first focused tests; foreground timeout 600000 ms; never run the full suite for this child.
• No refactor, new layer, model-name branch, unrelated cleanup, or scope expansion.
• Public API/CLI/config/rigctld compatibility changes must be called out explicitly.

Project fields
Priority=P1; Risk=high; Size=S; Phase=stable; Owner=codex; WorkType=bug.