feat: add safe BLE discovery and network baseline tools

docs/01_IMPLEMENTATION_PLAN.md

@@ -43,7 +43,7 @@ documenting the missing ground truth.
 STOP: serious fault, overheating, activation lock, or destructive/ambiguous
 device state.
 
-## Stage 1 — BLE read-only toolkit
+## Stage 1 — BLE non-mutating discovery and metadata toolkit
 
 Minimal dependencies: `bleak` plus the existing CLI stack. Add them only in the
 repository-local environment.
@@ -59,6 +59,8 @@ k1link ble listen
 Requirements:
 
 - preserve advertisement snapshots, manufacturer/service data and RSSI;
+- describe macOS scanning as active discovery: CoreBluetooth does not support
+  passive scan mode, although discovery does not change K1 configuration;
 - identify by observed name + macOS UUID + advertisement fingerprint;
 - inspect standby, scanning and USB states separately;
 - start with standard Device Information/Battery services;

docs/02_FIRST_LAB_RUNBOOK.md

@@ -49,7 +49,7 @@ Decision:
 - PAUSE USB analysis if recording works but USB is unavailable.
 - STOP on activation lock or device fault.
 
-## Experiment C — passive BLE surface
+## Experiment C — BLE discovery and metadata surface
 
 Prerequisite: Stage 1 BLE commands implemented and reviewed.
 
@@ -131,4 +131,3 @@ GO / PAUSE / BLOCKED:
 Evidence:
 Next smallest experiment:
 ```
-