feat: add safe BLE discovery and network baseline tools

docs/01_IMPLEMENTATION_PLAN.md

@@ -43,7 +43,7 @@ documenting the missing ground truth.
 STOP: serious fault, overheating, activation lock, or destructive/ambiguous
 device state.
 
-## Stage 1 — BLE read-only toolkit
+## Stage 1 — BLE non-mutating discovery and metadata toolkit
 
 Minimal dependencies: `bleak` plus the existing CLI stack. Add them only in the
 repository-local environment.
@@ -59,6 +59,8 @@ k1link ble listen
 Requirements:
 
 - preserve advertisement snapshots, manufacturer/service data and RSSI;
+- describe macOS scanning as active discovery: CoreBluetooth does not support
+  passive scan mode, although discovery does not change K1 configuration;
 - identify by observed name + macOS UUID + advertisement fingerprint;
 - inspect standby, scanning and USB states separately;
 - start with standard Device Information/Battery services;