v5→v4 reverse propagation: scoped (excludeTables) bridge route fails reverse-subscription auth, making post-cutover rollback lossy

### Summary

In a v4→v5 bridge migration, writes originated on the v5 side do **not** propagate back to the v4 source under the documented §3a bridge `add_node` payload. The v4 source repeatedly opens a reverse subscription to the bridge and the bridge rejects it (`Unauthorized database subscription to data`, code `1008`, thousands of cycles). Consequence: **rollback after cutover is lossy** for any write made on v5 post-cutover — the migration is one-directional at the bridge auth layer.

This is the issue the runbook §10 calls for filing, now that the gap is measured.

### It's payload-gated, not a product wall (Nathan's A/B)

Same merged-`main` build (harper-pro#331 + #309 in), same flow, A/B only on the bridge `add_node` payload:

- **§3a documented payload** (`excludeTables` route entries): **0 / 1,200** post-cutover inserts reach v4 — the 1008s above. Mechanism: the `excludeTables` route entries scope the bridge's `replicates` off `true`, which fails the reverse-subscription auth check.
- **`replicates: true` payload**: **1,200 / 1,200 from all four origins (leaves included)** reach v4 within the forwarding window; conflicting updates converge to identical state on both sides; v4 integrity intact. #331's transitive propagation worked throughout.

So lossless rollback works today on `main` — the decision is just **where the fix goes**:
1. teach the reverse-subscription auth check that an `excludeTables` route entry authorizes its database, or
2. give the §3a payload proper `receivesFrom { source, database }` grants.

### Why it matters

The runbook (§5/§6) currently mandates a hard one-way cutover and documents rollback as lossy specifically because of this. Closing this would allow a lossless rollback window during cutover — valuable for large/risky customer migrations.

### Repro / harness

harper-fabric-lab: `incidents/v4v5-rollback-2026-06-10/`, `BRIDGE_MODE=scoped|bidirectional`.

### Related
- Runbook §6 / §10 (v4→v5 Fabric Cluster Data Migration Runbook).
- harper-pro#331 (LOCAL_ONLY mesh-leak fix), #348 (at-scale full-copy, fixed in 5.1.0-beta.3).

🤖 Filed by Claude on Kris's behalf, from Nathan's bench measurements.