Ros2FaultServiceTransport::get_snapshots / get_rosbag (and the other RPC
methods) previously called rclcpp::Client::async_send_request and blocked
on the std::future. That required some external executor to be spinning
the host node, and TSan caught a race between the spin thread cleaning up
the client's pending request entry (execute_client) and the calling thread
destroying the local response shared_ptr when the function returned.

Give the transport its own MutuallyExclusive callback group, registered
on a private SingleThreadedExecutor, and drive each RPC via
executor_.spin_until_future_complete(). The client callback execution and
the response destruction now happen sequentially on the caller's thread,
which removes the cross-thread race entirely.

The seven per-method mutexes collapse into one executor mutex - the
underlying SingleThreadedExecutor is not safe for concurrent
spin_until_future_complete callers, so all RPCs serialise through it. The
host node's executor no longer needs to know about these clients.

The new callback group is created once at construction (single-threaded)
and stays on the transport's private executor, so the rcl hash-map race
that the no-naked-subscriptions gate guards against does not apply. Add
the file to ALLOWED_LEGACY_FILES with a note pointing back at this issue.

Closes #399

Build the seven fault service clients on a private rclcpp::Node owned by
Ros2FaultServiceTransport instead of a dedicated callback group on the host
node. The private node is driven by the transport's own SingleThreadedExecutor
via spin_until_future_complete(), so the host gateway node's executor never
processes these clients and the client callback / response destruction stay
on the caller's thread.

This avoids the create_client(name, rclcpp::QoS, group) overload, which does
not exist on Humble (rclcpp there only ships the rmw_qos_profile_t form), and
keeps the no-naked-subscriptions regression gate satisfied without an
allowlist entry, since create_client and create_node are not gated APIs.

All seven RPC methods now share one consistent shape: build the request
unlocked, then under executor_mutex_ wait for the service, send, spin to
completion and take the response; response translation happens unlocked.

Adds a regression test that completes a get_snapshots RPC while the host
node is never spun, proving the transport drives its private client itself.