kafka: gate 3.9 bridge-state MBeans and require the diagnostics opt-in

[bringhurst]

Make registration of the new bridge-state MBeans opt-in, rather than changing the default Kafka metric registry.

li.protocol.bridge.config.metrics.enable defaults to false. It applies only to ZooKeeper brokers and requires a restart. When explicitly enabled, it reports the current behavior flags without enabling those behaviors. Disabled instances do not unregister gauges owned by an enabled instance. Existing JVM constructors remain available.

The default-off regression fails before the fix on both release lines. Enabled values, dynamic behavior flags, restart scope, KRaft exclusion and cleanup tests pass afterward. The 3.9 process profile enables diagnostics explicitly; preflight requires the setting in every migration phase, including dormant mode. All 72 Python tests pass.

This is a paired follow-up to the identity-recovery stack. The wrapper mapping/test changes are being qualified against matching new jars. Final-source process and wrapper qualification are still required; this PR is not rollout approval.

[bringhurst]

The full verifier on e80460f / wrapper 1764cc95 reached the mixed-process stage after Scala compilation, focused broker tests, vendor pagination, full client/server/storage suites, archive checks and the 133-test wrapper suite. The process stage failed during the all-3.0 dormant backout, before 3.9 admission.

The old-client checkpoint file completed, but metadata churn stopped advancing at cycle 20. CreateTopics repeatedly returned TopicExists while deletion returned UnknownTopicOrPartition from AdminZkClient's missing-topic check. The runner correctly failed its phase-progress deadline. This is retained at /tmp/li-final-metrics-full; it is not a complete pass and is not being treated as a timeout to waive.

I am tracing the 3.0 controller/metadata-cache path for this mismatch. The later quota-window repair in #590 is independent and is not included in this failed bundle. Earlier passing process runs remain scoped to their exact sources and assertions.

[bringhurst]

The dormant-backout cache/ZooKeeper mismatch is now reproduced and repaired in #592. The 3.0 native path counted the only offline replica as deleted, skipped the metadata tombstone, and removed the topic assignment. Cleanup was enabled, but the acknowledgement rule previously checked bridge mode only.

The rule now applies while either bridge mode or the cleanup gate is enabled. Both disabled still preserve the native default. The four-combination unit regression fails before and passes after; 18 deletion/controller/cache tests pass. A real-broker target fails before with cached-topic=true / retained-assignment=false, and passes after with cached-topic=false / retained-assignment=true, followed by exact replacement-record verification.

#593 makes the actual runner case mandatory in scenario revision 5. Its four checks and rejection of revision-4/incomplete evidence are tested; all 82 Python tests pass. The actual runner method passed with the repaired archive. These targets remain partial migrations, and the earlier full failure remains failed.

A fresh complete full-suite verifier is running on the current pair. No timeout or progress check was relaxed.