…fqns

The same synthetic-component bug already fixed for /components/{id}/logs
also applies to BulkDataHandlers::get_source_filters. Synthetic /
runtime-discovered components have empty fqn AND empty namespace_path,
so the FUNCTION-only aggregation arm was not enough: components silently
returned zero source filters, producing empty rosbag descriptor lists
and failing ownership checks on download.

Extend the aggregation arm to handle COMPONENT identically - resolve
hosted apps via cache.get_apps_for_component() and build their
effective_fqn() list. Manifest deployments where a component groups
topics fall through to the existing namespace-prefix path.

Strengthen the integration test for the original logs fix: assert items
is non-empty (the bug returned 0 items with valid x-medkit metadata, so
app_count alone is insufficient) and match aggregation_sources by FQN
substring instead of bare app id. Add an integration test for component
bulk-data aggregation, and update docs/api/rest.rst to describe the
actual aggregation behavior for /components/{id}/logs.

…olve_app_host_fqns

Address review feedback on the component log/bulk-data aggregation fix:

- Extract the per-app FQN resolution loop (cache lookup + effective_fqn +
  empty-skip) to HandlerContext::resolve_app_host_fqns and call it from
  log_handlers (FUNCTION/AREA/COMPONENT branches) and bulkdata_handlers
  (FUNCTION/COMPONENT). Removes three duplicate copies of the same loop
  and gives both handlers a single unit-tested helper.
- Split FUNCTION and COMPONENT branches in BulkDataHandlers::get_source_filters.
  The previous combined arm fell through to entity.fqn / namespace_path for
  both types when host_fqns was empty, which silently changed FUNCTION
  semantics: functions are pure aggregated views and must return an empty
  filter list when no apps host them. COMPONENT keeps the fall-through for
  manifest-only deployments.
- Make BulkDataHandlers::get_source_filters public (was private). The
  branching logic is non-trivial and needs unit coverage; calling it
  through the REST surface forces a real FaultManager service which is
  not viable in unit tests.
- Add unit tests:
  * 7 ResolveAppHostFqnsTest cases pinning the silent-skip semantics
    (missing apps, empty effective_fqn, bound_fqn precedence).
  * 9 BulkDataSourceFiltersTest cases covering APP / AREA / FUNCTION /
    COMPONENT branching, including the regression guard that FUNCTION
    without hosts returns empty even if the entity carried a fqn.
  * 3 ComponentLogs* cases on the existing AreaAggregationTest fixture
    that exercise the COMPONENT branch in handle_get_logs end-to-end via
    the REST server: synthetic component aggregates from hosted apps,
    manifest-only component falls through, empty component returns empty
    items without crashing.
- Set ROS_DOMAIN_ID for test_bulkdata_handlers (now stands up a real
  GatewayNode, needs domain isolation per CMakeLists.txt convention).
- Strengthen the integration test for component logs aggregation:
  * Wrap the assertion in poll_endpoint_until - the /rosout buffer fills
    asynchronously after node startup, the prior immediate assertion was
    timing-dependent.
  * Match aggregation_sources by FQN substring instead of bare app id
    (the response carries full FQNs like /powertrain/engine/temp_sensor).
- Clarify docs/api/rest.rst: app_count and aggregation_sources are
  populated only when hosted-app aggregation is active and are omitted
  under the namespace-prefix fallback.

…-error

The rosdep keys for ``ament_cmake_clang_tidy`` and ``ament_cmake_clang_format``
are not registered for noble (the Rolling runner image), so ``rosdep install``
hard-fails before the build can start. Linters / clang-tidy already run only
in the Jazzy job in ``quality.yml`` (gated by ``ENABLE_CLANG_TIDY`` in
``ROS2MedkitLinting.cmake``), so the build-and-test matrix on Humble + Rolling
does not need those CMake packages installed - skip the keys instead of
trying to resolve them. ``opcua-plugin.yml`` already follows the same pattern.

Drop ``continue-on-error`` for the Rolling job. Rolling is now treated as a
required-green distro per CLAUDE.md - any Rolling-specific failure is a real
breakage that needs a code-side fix or an explicit owner sign-off, not a
silent soft-fail.

ci.yml skips the ``ament_cmake_clang_format`` rosdep key on Humble + Rolling
(linters only run in the Jazzy quality job, the rosdep key isn't even
registered for noble), so ``find_package(... REQUIRED)`` hard-fails the
configure step on those runners. Switch all 8 affected packages to
``find_package(ament_cmake_clang_format QUIET)`` plus an ``if(_FOUND)``
guard around the corresponding ``ament_clang_format(...)`` call. On Jazzy
(where the package is installed in the quality job's rosdep step) the
behavior is unchanged - clang-format still runs and passes 310 tests on
``ros2_medkit_gateway``. On Humble + Rolling the configure step now
proceeds without the package and the linter is silently skipped, which
matches the project policy that linters only run on Jazzy.

The companion ``ament_cmake_clang_tidy`` find_package in
``ROS2MedkitLinting.cmake`` is already gated by the ``ENABLE_CLANG_TIDY``
option (default OFF; only set ON in the Jazzy clang-tidy job in
quality.yml), so no change needed there.

…test job

The opcua-plugin Unit tests matrix runs on humble + jazzy + rolling. On
noble (Rolling) the ament_cmake_clang_format / ament_cmake_clang_tidy
rosdep keys are not registered, so the previous skip-keys list (which
covered only nav2_msgs) caused rosdep install to fail before any test
could run.

Add the linter keys to skip-keys, mirroring the change just made in
ci.yml. The upstream medkit packages have already been switched to
QUIET + FOUND for those find_package calls so the build degrades
gracefully when the linter packages aren't installed.

The first RUN clears ``/var/lib/apt/lists/*`` to keep the builder image
small. The next RUN then calls ``rosdep install``, which in turn invokes
``apt-get install`` under the hood without first refreshing the apt cache.
On cold Docker builds this fails with ``E: Unable to locate package
python3-jsonschema`` (declared as a ``<test_depend>`` by
``ros2_medkit_integration_tests`` and pulled in by rosdep even with
``BUILD_TESTING=OFF``). The OPC-UA plugin Integration jobs were
masking this on main via warm BuildKit layer caches and only blew up
after the cache was evicted.

Add an explicit ``apt-get update`` at the start of the rosdep RUN, and
move the ``rm -rf /var/lib/apt/lists/*`` cleanup to the end of the same
layer so the runtime image still inherits no apt cache.