Add audited, versioned MCP save workflow (#1452)

- `--export ... --target-version`, and explicit target_format /
  target_version on automation and protocol saves; a conversion that
  would drop unsupported records is refused unless allow_lossy is set.
- `audit` read op: dangling layers/blocks, duplicate handles, non-finite
  bounds, serialization, lossy records and the source DXF handle graph.
- `save_verified`: writes the requested version from the same snapshot a
  normal save writes, reopens it, checks the version and the entity
  manifest, audits the ASCII DXF handle graph and returns a SHA-256.
- ZOOM EXTENTS includes SDF text glyphs.
- Live MCP acceptance script and an optional reference-console audit
  runner under docs/automation.

Squashed from the PR with review fixes: merged with the DWT save path,
the save snapshot, the tool lists added since, and vendor-neutral
harness names; the dated verification record is left out.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/cli.rs

@@ -95,6 +95,11 @@ pub struct Cli {
     #[arg(help = crate::t!("Convert IN to OUT using the output file extension, then exit.").into_owned(), long_help = None)]
     pub export: Option<Vec<PathBuf>>,
 
+    /// Explicit output CAD version for --export (R14, 2000, 2004, 2007,
+    /// 2010, 2013 or 2018). Without it the source document version is kept.
+    #[arg(long, value_name = "VERSION", requires = "export")]
+    pub target_version: Option<String>,
+
     /// Run a command script at startup: one command line per line of FILE.
     #[arg(long, value_name = "FILE")]
     #[arg(help = crate::t!("Run a command script at startup, one command per line.").into_owned(), long_help = None)]