feat(kernel): wire ABI-version check, mTLS, and CloudFetch toggle options

[mani-mathur-arch]

What

Wire the four new kernel C-ABI symbols on the driver side, extending the existing experimental-config surface:

• checkABIVersion() — a sync.Once handshake at the top of OpenSession compares the linked library's kernel_abi_version() against the header macro and refuses to connect on a mismatch.
• WithKernelClientCertificate(cert, key) — mTLS client identity via the paired setter. Both PEM halves required together (validateKernelConfig rejects an unpaired credential loudly); the key is never logged.
• WithKernelCloudFetch(enabled) — a tri-state *bool (nil keeps the kernel default on; set forwards the toggle). Distinct from the plain-bool WithCloudFetch.

All three are kernel-only and rejected loudly on the Thrift path; the reflective classification guard is extended so a new experimental field can't ship unforwarded/unrejected. CloseSession stays fire-and-forget (adopting kernel_session_close_blocking would make close a blocking round-trip with no deadline — grouped with the cancellable-close follow-up).

Closes PECOBLR-3648 / 3652 / 3653 (driver side).

Stacked on #409 (mani/sea-kernel-ctx-cancel). Draft — CI build is red until KERNEL_REV is bumped to a merged kernel SHA carrying the new symbols.

Tests

• Untagged: experimental-field classification guard + option→config wiring + Thrift fail-loud rejection + DeepCopy (all under CGO_ENABLED=0); mTLS-pairing validation.
• Tagged: TestSetKernelTLS mTLS marshalling case, TestABIVersionMatches. Live-verified on staging (WithKernelCloudFetch(true) connects; (false) reaches the server and hits the documented CAN_CLOUD_DOWNLOAD gate). Default build unchanged.

Co-authored-by: Isaac

[mani-mathur-arch]

Consolidated into #409 — all commits from this PR were folded (DCO sign-offs added) into mani/sea-kernel-ctx-cancel at 7e11982, which is now the single PR merging into main.