M2.14→M2.15 BCUGE: complete CFG/DAT/RIO bundles on verified MMS root without engine repin

[masarray]

User acceptance: COMTRADE files named identically belong to one download

Supersedes blocked experimental consumer #600, whose engine pin replacement tripped physically anchored safety/interop CI guards. This safer branch is stacked on green #599, keeps exactly the validated ARIEC pin 036e2c00d83a0815b6160147b14ea05975057965, and does not bypass any engine guard.

• The engine remains the sole authority for complete primary CFG+DAT records and the existing dedicated MMS downloader remains the sole wire/transfer implementation.
• Reconcile only a physically listed .rio file from the same root MMS FileDirectory response with an already verified complete ARIEC CFG/DAT record and exactly matching directory and basename (ordinal). Reject alias duplicates, same-named other-folder files, or missing/mismatched server filename. No SCL or guessed paths.
• Project one verified bundle row line_1, with per-selection members CFG + DAT + RIO and exact count/bytes; orphan RIO remains browse-only.
• Use the engine's existing single transactional downloader by appending the physically observed RIO as an ancillary typed file record. This pinned engine predates a dedicated RIO enum, so its Information kind is used strictly for transfer ordering; extension remains .rio and is never misrepresented as .inf. Future upstream ARIEC #170 can replace this compatibility seam after qualification.
• Existing completed-download validation and hash-based manifest require the extra file. Unknown RIO modification time disables unsafe cached-reuse: no assumption of unchanged remote content.
• Index exact path identities once (O(N) catalog reconciliation), no background network poll, no extra download association, no writes.
• Regression: 3-file logical bundle, physical-only root-first, orphan, duplicate names/case, different directory, incomplete CFG/RIO, missing local RIO / length, source catalog unchanged, SCL-only cannot authorize.

Coverage limitation: root FileDirectory RIO only; the historical engine does not reveal raw unknown extension entries from recursive subdirectory scans. Do not claim subdirectory RIO support without a new engine contract. No main merge or release until CI and BCUGE physical acceptance.