R1A: canonical Signal Catalog and offline DataSet browsing in IED Browser - #130

Milestone R1A — IEDScout-style operator workflow without protocol regression

Based on green recovery commit 8b077f5e (PR #127), not the old broken UX branch.

• Introduce compact read-only Signal Catalog for Open SCL and live discovery, with Dataset Signals / Browse All Signals and explicit member selection.
• Display DataSet membership from the canonical engineering context even while offline; select the live report controller by exact reference only when already connected. Keep verified runtime inventory and owned dynamic entries available.
• Preserve ordered FCDA labels and normalize FC evidence only for canonical node lookup / explicit bounded Read members; no automatic MMS polling, dynamic DataSet create, RCB binding rewrite or GI.
• After successful live discovery, offer the catalog once per canonical context generation; manual action remains available for Open SCL and re-entry.
• Add synthetic offline DataSet to rendered Browser fixture and verify member count + actual rendered member text. Add a source safety contract to Qt CI.

Exit gates

• Exact-head Qt and Release Hardening green, including BROWSER_DATASET_CATALOG_PASS and no QML binding errors.
• Windows portable/installer from the same tested head before operator acceptance.
• Real-device AA1E1F06R4 acceptance still required for full R1; synthetic testing does not prove real reporting.
• Leave PR P0: restore active Browser panel routing and enforce rendered QA #127 recovery and main unchanged until review/acceptance. Tracks Milestone R1 — Open SCL and Discovery converge into verified static reporting #129.

R1A acceptance checklist: #131. Parent static-report milestone: #129.

Independent P0 security blocker

The reporting fuzzer found an unrelated pre-existing unsigned underflow in src/mms/reporting.cpp (ASan run 36316147544). Tracked in #132; isolated fail-closed correction and regression tests in #133 against main. No MMS engine changes are introduced by this R1A GUI PR. Do not suppress Security and Evidence or declare a release until the fix is validated and incorporated in the release lineage.

Verified exact-head R1A evidence (7d7cc5e)

• Qt CI: success; canonical Signal Catalog source contract and rendered offline DataSet member QA passed.
• Linux Release Hardening: success; log contains BROWSER_DATASET_CATALOG_PASS and BROWSER_FLEET_ROUTING_PASS, with no QML TypeError, ReferenceError or binding loop. Windows portable/installer packaging remains in progress at this note.
• Milestone checklist R1A — Signal Catalog and offline canonical DataSet Browser #131; next exact static RCB workflow R1B — Static DataSet to exact RCB reporting workflow #134. Real-device AA1E1F06R4 is not covered by synthetic QA.