Route gadget_checker propagation through the shared measurement-crossing flip ledger

[ciaranra]

Item 2 of #411.

Problem

GadgetChecker carried its own hand-rolled gate dispatch in two places -- the end-to-end walk (propagate_through_circuit) and the per-round syndrome-history walk (propagate_up_to_tick) -- and both treated state preparation and measurement as identity. That was a fourth opinion about measurement crossings, and a wrong one:

• A component surviving a measurement could rotate through a later H and spread through a CX, manufacturing phantom output errors, phantom logical errors, and phantom syndrome flips from harmless faults.
• A re-preparation did not clear the wire, so on reused ancillas round-1 flip evidence leaked into round 2's syndrome.
• Worse, the end-to-end path merged this identity walk with propagate_faults -- which already uses the checker's shared flip ledger -- so a single analysis mixed two different crossing semantics.

Fix

Both walks now apply every gate through apply_gate_flip_ledger, the same end-read ledger used by propagate_faults and the fault-tolerance checker's own walkers: a measurement absorbs the commuting component and keeps the outcome flip readable (basis-aware, MZ and MX), and a preparation clears the wire. This also strictly widens unitary coverage -- the hand-rolled dispatch silently ignored gates outside its list, while the shared dispatch handles the full named-Clifford set plus Clifford-angle rotations.

Tests

Four crossing regressions, each pinned by mutation:

• a_preparation_clears_a_fault_arriving_before_it, a_measurement_absorbs_the_commuting_component, and measurements_keep_the_anticommuting_flip_readable kill a mutant that restores identity crossings in the end-to-end walk (and only that mutant's site).
• round_history_respects_measurement_and_reprep_crossings kills the same mutant applied to the history walk: an X just before round 1's readout flips round 1 and only round 1, and a Z there is harmless in every round.

All 28 gadget tests pass; the 24 pre-existing ones are unchanged, confirming none of them ever exercised a measurement crossing -- which is how the defect lived this long.

Boundary noted

With one shared ledger, a fused MPZ's own-round flip is invisible to per-round reads in both this walk and the canonical checker's (propagate_until_tick processes the round tick inclusively, and MPZ's reset half clears the flip before the read). That is pre-existing on the canonical side and is filed separately with evidence rather than silently choosing a model here.

Verification

cargo fmt --check, cold cargo clippy --locked --workspace --all-targets -- -D warnings on a fresh target, the full pecos-qec suite, the CI-shaped workspace test set, and pre-commit run --all-files -- all green.