fix(core): scope Bedrock principal admission to Bedrock

[minekube-ai-engineer]

Bug Description

Connect Java 0.15.x rejected ordinary Java sessions with BedrockPrincipalAdmissionException: READINESS when generation-2 Bedrock principal mode was require. This prevented Java players from joining newly configured endpoints.

Root Cause

BedrockPrincipalConsumer enforced the presence of a signed Bedrock v2 envelope before checking the trusted session protocol. Java sessions correctly carry no Bedrock envelope, but were rejected as if they were Bedrock sessions.

Fix

• Scope missing-envelope enforcement to sessions marked SESSION_PROTOCOL_BEDROCK.
• Preserve ordinary admission for Java and legacy unmarked sessions.
• Continue rejecting Bedrock sessions missing required envelopes.
• Continue rejecting non-Bedrock sessions carrying Bedrock envelopes or reserved injected principal properties.

How to Verify

1. Configure generation-2 Bedrock principal mode as require.
2. Submit a Java session without a Bedrock principal envelope; it proceeds through ordinary admission.
3. Submit a Bedrock session without its required envelope; it is rejected with READINESS.

Test Plan

• Added Java admission regression coverage.
• Added legacy unmarked-session compatibility coverage.
• Added protocol-confusion and reserved-property injection coverage.
• ./gradlew :core:test --tests 'com.minekube.connect.bedrock.BedrockPrincipalConsumerTest' --no-daemon
• ./gradlew check --no-daemon
• Independent pre-commit review passed with no security or logic findings.

Risk Assessment

Low — the bypass applies only when the trusted protocol is not Bedrock and no Bedrock v2 envelope exists. Bedrock require-mode behavior remains fail-closed.