app: core-engine — run engine; full server-facing vertical proven vs fmr

Composes core-protocol probes into core-measurement documents. Injected
clock/UUID source keeps it pure and unit-testable. Runs a server ECHO
train and derives RTT distribution, loss, and NAT-rebinding detection
(from the server's observed source port) as train.udp_updown, then
findings + a §7.3 summary.

Verified end-to-end against fmr: 20-packet train, 0% loss, RTT
1.7/2.5/6.9ms, no rebinding → valid MeasurementDocument (2.3kB), overall
GREEN. The whole server-facing stack (protocol → engine → schema →
verdict) now produces the real product artifact against the live server,
no device required.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

echolot-app/core-engine/build.gradle.kts

@@ -0,0 +1,29 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+plugins {
+    alias(libs.plugins.kotlin.jvm)
+    alias(libs.plugins.kotlin.serialization)
+}
+
+// The measurement run engine: composes core-protocol probes into
+// core-measurement documents. Pure Kotlin/JVM, so it is unit-testable and can
+// run a full server-facing measurement against a live server.
+dependencies {
+    implementation(project(":core-protocol"))
+    implementation(project(":core-measurement"))
+    implementation(libs.kotlinx.serialization.json)
+    testImplementation(kotlin("test"))
+}
+
+kotlin {
+    jvmToolchain(21)
+    compilerOptions { jvmTarget.set(org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_17) }
+}
+java { sourceCompatibility = JavaVersion.VERSION_17; targetCompatibility = JavaVersion.VERSION_17 }
+
+tasks.test {
+    useJUnitPlatform()
+    listOf("ECHOLOT_LIVE_URL","ECHOLOT_LIVE_PIN","ECHOLOT_LIVE_CRED","ECHOLOT_LIVE_UDP","ECHOLOT_LIVE_TARGET")
+        .forEach { k -> System.getenv(k)?.let { environment(k, it) } }
+}