Prepared mounted rearm second courier leg — NOT integrated gameplay

Patch scope
- NEW ERR_MountedAmmoTransfer.c (transaction plus its callback).
- ERR_FiniteMagazineReservation.c: committed flag, exact read-only CommittedFor,
  one-shot ClaimMountedSwap; all current Reserve/Commit/Release rules preserved.
- NEW tests/test_mounted_ammo_transfer.py: actual constructor/method/callback
  bodies executed with controlled native doubles, not engine coverage.
Do not apply only the shared-helper hunk to production: it is consumed by the
prepared transaction, which itself needs the courier coordinator below.

Constructor contract
ERR_MountedAmmoTransfer(mode, originalTask, targetVehicleIndex,
 originalTargetRoster, originalWorkerSlot, originalWeapon, originalMuzzle,
 originalLoadedMagazineEntity, alreadyCarriedIncomingEntity, committedPickup)

The coordinator must retain original weapon/muzzle/loaded identities before
courier dispatch, from the exact production mounted collector/ownership checks.
It must retain the original recipient crew sampler, choose a surviving original
member other than the seated original driver, and keep the original vehicle
root bound. Construction pins the exact task/receipt/vehicle objects, roots,
groups, force records, worker, magazine components, storage managers and slots.
It does not discover or bind replacements. Index1 is the original ammo truck;
recipient is another original root in the same six-vehicle task.

Required caller integration (not in this patch)
1. Require a fresh delivered mounted-low-ammo report, then validate original
   task/source binding and acquire exclusive recipient/muzzle/worker orders.
2. Select a compatible exact identity from the existing infantry coordinator's
   original m_Stock/m_Spent arrays. Reserve via ERR_FiniteMagazineReservation;
   keep the same handle alive across both courier legs.
3. Physically move original worker to truck cargo access and perform finite
   pickup. Existing ERR_InfantryAmmoTransfer cannot be reused unchanged: its
   Compatible(worker,box) demands the worker's carried small arm uses that box.
   An AK-equipped crew member carrying a PKM box needs a specific courier pickup
   contract, preserving donor storage ownership, physical cargo access, exact
   callback + destination proof and the existing no-duplicate quarantine.
4. Commit that handle when pickup is submitted, as for existing infantry.
   Start the second leg only after pickup reports SUCCEEDED, with its callback
   and exact ownership both proven. A committed handle alone is not proof of a
   successful first leg. Keep uncertain pickup claims quarantined.
5. Send the same original worker on foot to the exact original mounted slot;
   keep both original vehicles stationary and original drivers/crew valid.
   Normal ~35m vehicle spacing does not require moving vehicles together.
   Constructor/Tick never move anyone, request cargo or bypass mounted-crew hold.
   The coordinator must authorize ordinary dismount/approach/reboarding and
   protect these orders from the existing convoy tactics/HQ scheduler.
6. Construct this leaf at the rendezvous; Tick accepts milliseconds and has an
   8000ms monotonic deadline. It is not a navigation timer. The original loaded
   box must still be <=25% full and incoming must carry more rounds.
7. The caller must hold a strong ref ERR_MountedAmmoTransfer while a native
   callback or quarantine is live; the callback Transfer backlink is weak.
   Keep both exact items/slots and the recipient claim reserved while Unresolved
   is true, including after Stop, failure, deadline or mission end. Polling proof
   after late callback can settle quarantine, but never restarts or succeeds a
   stopped/failed transaction. A false native return without callback stays
   conservatively unresolved. Never refund the incoming finite identity.
8. Success leaves the original outgoing box carried by the worker. It is not
   automatically new usable stock, nor is it returned remotely to the truck.
   A later physical return/reboarding/cleanup stage is still needed.

Leaf behavior
- Context rechecks current server/active mode, exact consumed receipt/record
  identity, six original task slots, original root/crew bindings, worker roster,
  on-foot conscious enemy ownership, alive stationary truck and recipient.
- Source is the original worker's managed deposit storage, <=64 storages and
  <=128 inventory identities. Incoming and outgoing must both be absent from
  the original truck inventory. No same-item swap, remote truck swap or reload
  fallback. Original gun/mount/muzzle relation and exact parent slots retained.
- Reach is <=4m from worker aiming position to the exact authored mounted
  InventoryStorageSlot.GetWorldTransform position, with finite coordinates and
  WORLD|ENTS camera-layer trace. Only worker and actual gun hierarchies are
  excluded; original vehicle hull and unrelated objects remain occluders.
- Only native mutation is one TrySwapItemStorages(incoming,outgoing,callback)
  through the original worker manager, preceded by CanSwapItemStorages. The
  committed finite reservation grants at most one mounted native submission
  across competing transaction objects, consumed before calling native code.
- No content mutation, chamber manipulation, spawn, delete, replacement,
  teleport, retry or reservation refund. Native swap handles existing contents.
- Callback alone is insufficient. Success requires BOTH exact parent/attached
  slots exchanged, actual muzzle magazine switched, and worker inventory
  contains outgoing but not incoming. Callback failure remains sticky; partial
  movement stays quarantined. Inline success + native false is accepted only
  with ordinary proof; no late callback changes terminal gameplay state.

Established native APIs and remaining evidence
- generated/InventorySystem/InventoryStorageManagerComponent.c lines35-37:
  CanSwapItemStorages(itemA,itemB), TrySwapItemStorages(itemA,itemB,cb).
- generated/InventorySystem/InventoryTask/ScriptedInventoryOperationCallback.c:
  OnComplete/OnFailed for an operation; OnAllComplete/OnAllFailed described for
  multiple spawns. Both success notifications may be accepted here because
  exact two-item slot proof is mandatory; no assumption of per-item ordering.
- generated/InventorySystem/InventoryStorageSlot.c -> EntitySlotInfo ->
  generated/PointInfo.c: GetWorldTransform(out vector[4]). All above installed
  references under /tmp/erri-vanilla-stock/scripts/Game.
- /tmp/erri-horn-read/MG_PKM_base.et authors magazine pivot/context around
  lines289-294. Stock support-station action scripts use their support/resupply
  framework; this leaf never invokes or simulates those resource-based actions.
- Prior native dry query proved original PKM slot/storage and compatible initial
  truck box can be swapped, without mutation. It did NOT prove worker-carried
  CanSwap, authored slot reach, collision result, actual native swap, callback
  sequence, worker carrying capacity, outgoing return or multiplayer behavior.
  Those require an explicit bounded native courier fixture after integration.

Focused validation (all PASS with proposed shared helper)
PYTHONPATH=/home/jakub/devel/escapistsrereintroduced/tests \
 ERR_MOUNTED_TRANSFER_SOURCE=/tmp/erri-mounted-transfer/addons/core/Scripts/Game/ERR/10_AI/ERR_MountedAmmoTransfer.c \
 ERR_FINITE_RESERVATION_SOURCE=/tmp/erri-mounted-transfer/addons/core/Scripts/Game/ERR/10_AI/ERR_FiniteMagazineReservation.c \
 python3 /tmp/erri-mounted-transfer/tests/test_mounted_ammo_transfer.py
ERR_FINITE_RESERVATION_SOURCE=/tmp/erri-mounted-transfer/addons/core/Scripts/Game/ERR/10_AI/ERR_FiniteMagazineReservation.c \
 python3 /home/jakub/devel/escapistsrereintroduced/tests/test_finite_magazine_reservation.py
ERR_FINITE_RESERVATION_SOURCE=/tmp/erri-mounted-transfer/addons/core/Scripts/Game/ERR/10_AI/ERR_FiniteMagazineReservation.c \
 python3 /home/jakub/devel/escapistsrereintroduced/tests/test_infantry_ammo_transfer.py

No target source writes, native sessions, staging or full-suite run by this task.

Independent read-only review: hq_memory_review found no concrete blocker and
independently executed the actual transfer regression successfully.
