#27 CI twin for PR #26

Fork PRs skip the Rust matrix; twin for iceteaSA's #26 at 8a4d21c7.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

---

Summary by cubic

Adds a control‑plane census supervisor.routes to enumerate live route consumers per module, including during drains. Previously routes were not observable; now the daemon reports consumer identity, route age, and draining state without querying modules.

• subc-control (0.1.2): adds ops::SUPERVISOR_ROUTES, ClientControlRequest::SupervisorRoutes, and ClientControlResponse::SupervisorRoutes. Consumers are reported as reserved { module_id } or direct { connection_id }, with age_ms and draining.
• Forwarding: retains principal and bound_at in RouteBinding; introduces endpoint_routes and route_census that snapshot under a single read lock and preserve draining status.
• subc-core (0.3.2): wires handle_supervisor_routes to the forwarding census; updates bench harness to use Principal::Direct; expands thin-core op catalog.
• CLI: adds ck routes [<module-id>] with table or --json output.
• Tests/goldens: new and updated fixtures for the op and catalog; ensure control‑plane‑only behavior (not exposed via MCP or agent tools).