feat: implement Table 30 Row-2 evt[2:0] validation — UART (6th endpoint type)

[SoundMatt]

Summary

Implements TC18 (OPEN Alliance TC18 Remote Control Protocol Specification v0.5.1_RC) §13.5 Table 33's "Row 2" evt[2:0] request classification for the UART endpoint type — the 6th of the 8 endpoint types sharing this row ({ADC, PWM_IN, I2C, LIN, CAN, UART, ISELED, MDIO}), following the pattern already merged for I2C (#114), ADC (#115), PWM_IN (#116), LIN (#117), and CAN (#118).

Rule (Table 33, TC18.txt L4085-4092): evt[2:0]==000b → Plain (ordinary request), 001b-110b → Reserved (reject with EndpointErrc::reserved_evt_row2, wire error UNSUPPORTED_CMD), 111b → ConfigWrite (§12.7.1 functional-config write — not yet implemented; reported via new UartErrc::config_write_not_supported).

Scope difference from every prior batch in this series

UART was not wired into include/rcp/mock.hpp at all before this change (grep -n "uart\|Uart\|UART" include/rcp/mock.hpp returned nothing on main). This PR wires UART into mock.hpp as the 8th mock endpoint (byte_bus_id=8) for the first time, not merely extending an existing wiring.

UART also has two separate request-side entry points — enqueue_tx(bytes) for writes and handle_read(read_size, elapsed_ms, uart_timeout_ms, ...) for reads — rather than one unified transfer()/transmit() call the way I2C/LIN/CAN have. UartEndpoint::handle_request classifies evt[2:0] via rcp::endpoint::evt_row2_kind_of exactly once, then routes a Plain request on an explicit is_write argument (mirroring the caller's req.op) to enqueue_tx or handle_read; Reserved/ConfigWrite reject before either queue is touched. mock.hpp's new dispatch_uart follows dispatch_gpio's existing req.op-branching convention to shape the write (WriteResponse) vs. read (ReadResponse) response.

TC18 verification

• Table 33 confirms UART is a Row 2 type: TC18.txt L4085-4092 lists "ADC, PWM_IN, I²C, LIN, CAN, UART, ISELED, MDIO" by name against "000b to 110b reserved – request to be rejected with error code = UNSUPPORTED_CMD" / "111b: ... used to change the configuration of the endpoint (see 12.7.1)". uart.hpp's pre-existing header comment ("has no evt[2:0]/channel decode of its own") described only the absence of a channel/value selector (unlike SPI's dedicated row) — not an exemption from Table 33's shared classification. The header comment is corrected to state this explicitly.
• UART's own request-handling section is §13.7.8 ("Endpoint type: UART"), specifically §13.7.8.1 (TX/RX independence, read-completion rule) and §13.7.8.3 (payload-less-read-only rule: "A read request having a byte_msg_payload will be rejected with error code = UNKNOWN_CMD"), TC18.txt L5289-5406. Both the payload-less-read-only rule and the read_size/uart_timeout race are confirmed orthogonal to Table 33's evt[2:0] classification and are not folded into handle_request — handle_request's own comment calls this out explicitly, and the payload-less-read-only rule remains unimplemented (out of scope for this pass, same as this codebase's existing "accepted limitation" pattern elsewhere).

Changes

• include/rcp/uart.hpp: UartErrc::config_write_not_supported (5) + UartEndpoint::handle_request(evt_op, is_write, tx_bytes, read_size, elapsed_ms, uart_timeout_ms, out_data, out_timed_out).
• include/rcp/mock.hpp: kUartEndpointId/kUartByteBusId (8), uart_ member + uart() accessor, dispatch_uart wired into dispatch(), wire_error_code_for mappings for config_write_not_supported (required) and read_size_exceeds_bound/tx_queue_overflow (reachable via dispatch, mirroring precedent's practice of mapping only dispatch-reachable error values).
• tests/test_uart.cpp, tests/test_mock.cpp: Plain (TX and RX routing separately), Reserved×6, ConfigWrite, and evt_op-masking coverage at both the endpoint and mock-dispatch level, mirroring the CAN/LIN PRs' test shape.
• .fusa-reqs.json: REQ-UART-008 (cybersecurity-tagged, matching precedent's per-endpoint-classification tagging pattern — see feat: implement Table 30 Row-2 evt[2:0] validation — CAN (5th endpoint type) #118's REQ-CANEP-008)/REQ-UART-009, REQ-MOCK-001 updated (seven- → eight-endpoint), REQ-MOCK-021/REQ-MOCK-022. Both tc18_master_id links (TC18-13.5-001, TC18-12.7.1-001) independently re-verified against RELAY's docs/tc18-master-catalog.json — each entry's own title/summary already names UART/evt[2:0]=111b exactly, reused unchanged from the CAN PR's precedent (the RELAY catalog's TC18-13.5-001 summary explicitly enumerates "ADC/PWM_IN/I2C/LIN/CAN/UART/ISELED/MDIO").

Verification

• cmake -S . -B build -G Ninja && cmake --build build: clean.
• ctest --test-dir build: 53/53 passing.
• cpfusa check --strict: 0 errors (2 warnings / 1 info, both pre-existing and unrelated — .fusa-evidence.json/CHANGELOG.md/HARA ASIL note).
• cpfusa trace: 100% traced + tested (402/402).
• cpfusa trace --sec-tested 17: passes (70/402 cybersecurity-tagged requirements, ~17.4%).
• Mutation test: temporarily changed handle_request's ConfigWrite case to fall through to Plain's TX/RX routing, rebuilt — REQ-UART-009's endpoint-level test and REQ-MOCK-021's mock-dispatch config-write test both failed as expected (system:0 == rcp.uart:5 mismatch). Cleanly reverted; git diff shows no stray leftovers; full suite green again (53/53).

Does not merge — for review.