fix: migrate engine fields to AtomicReference snapshots (S3077, Phase 3)

[jlouvel]

Summary

Phase 3 of the Sonar bug remediation blueprint. Migrates the remaining 13 volatile fields across 5 engine-layer classes from the volatile keyword to AtomicReference<T> (or static AtomicReference for resettable singletons) holding immutable snapshots.

This is the engine-layer counterpart to #423 (spec POJOs), and addresses the same SonarQube rule java:S3077. The two PRs touch disjoint files and can land in any order.

Closes #424.

Files migrated

File	Fields	Pattern
io.naftiko.Capability	spec, serverAdapters, clientAdapters, aggregates, bindings, scriptingSpec, stepHandlerRegistry	A (scalar), B (List wrapping CopyOnWriteArrayList), C (Map snapshot)
io.naftiko.engine.consumes.ClientAdapter	capability, spec	A
io.naftiko.engine.exposes.mcp.McpServerAdapter	stdioHandler, stdioThread	A
io.naftiko.engine.scripting.ScriptStepExecutor	scriptingSpec	A + per-call snapshot in execute()
io.naftiko.engine.observability.TelemetryBootstrap	static instance	static AtomicReference (singleton is reset at runtime by init/forTesting/reset, so the IODH idiom does not fit)

Why AtomicReference and not the holder idiom

• All instance fields are mutated post-construction (setters, hot-reload-ready).
• TelemetryBootstrap.instance is explicitly reset at runtime by init(String, ObservabilitySpec), init(OpenTelemetry) and reset() — the initialization-on-demand holder idiom assumes a write-once singleton, which does not match this lifecycle.

Notes for reviewers

• ScriptStepExecutor.execute() now snapshots scriptingSpec once at entry into a local of the same name, so all subsequent reads in the method observe a consistent view for the duration of the call (avoids races with a future hot-reload setter).
• Capability constructor builds local list variables fully before publishing them via AtomicReference#set — avoids partial-state observation if the constructor throws.
• List slots wrap CopyOnWriteArrayList inside the AtomicReference so request-handling iteration remains lock-free even if a future hot-reload swaps the slot.
• ClientAdapter#setSpec(HttpClientSpec) keeps its subtype-narrowing parameter (intentional, predates this PR).

Test plan

• New meta-test EngineFieldThreadSafetyTest (5 parameterized cases) — reflects over each migrated class and asserts no field is volatile. Acts as a regression guard.
• Full local suite: 926 tests, 14 failures, 0 errors. The 14 failures are the pre-existing LLM-flaky tutorial integration tests (Step{2-8,10}Shipyard*IntegrationTest) that return prose like "The..." instead of JSON, causing Unrecognized token 'The' — same set as on main and unaffected by this change.
• Bug Workflow followed: failing test committed first (test: add failing meta-test...), then fix (fix: migrate engine fields...).