Story: Clean ores.variability to the component clean standard

ores.variability meets the Component Clean Standard: the items marked All, Entity and Protocol pass, each item that does not apply is recorded with its reason, and ores.variability joins COMPONENTS_UNDER_TEST. Order 16 of 35 in the sprint 26 component clean-up, tier 2 (higher infrastructure).

• Every checklist item that applies to a component of kind Entity and Protocol passes, with its evidence recorded on the task.
• Every item that does not apply is recorded as not applicable, with the reason.
• Every generator defect found is fixed at its source, with a regression test.
• ores.variability is listed in COMPONENTS_UNDER_TEST, and check_component_drift.py --all passes.

• Survey on 2026-09-23: 0 entity, junction or operation models; 39 C++ files outside tests, 0 of them generated (0%); 3 messaging headers, 3 of them hand-written.
• Has SQL and hand-written protocol headers but no models: its wire types need models (M06, P04).
• Re-survey on 2026-09-26 with survey_component.py --project projects/ores.variability: 0 models; 45 C++ files outside tests, 0 generated (0%), 20 of them in generatable families and 2 unclassified; 1 hand-written protocol header declaring 6 subjects, none declared in a model.
• The component is Entity as well as Protocol: it owns ores_variability_system_settings_tbl, a bitemporal table, with a repository, a service and a NATS handler. The earlier Protocol label understated the work.
• It has no entry in the component catalogue, so codegen has never run on it and check_component_drift.py cannot address it by name. The scaffold comes first.

• The wire key is a new surrogate id uuid, with name kept as the natural key. The schema break is accepted because the natural key is what makes codegen emit get_system_setting_by_name(...), the accessor the in-process consumers need. Taken 2026-09-26; reasoning in D1 of the task.
• The component is consumed in process as well as over NATS, and that surface is not an aberration: four components link ores.variability.core.lib from production code, and thirteen link ores.history.core the same way. Codegen already supports it, because a generated entity's core library exports a documented service class and an entity with a natural key gets a by-natural-key read. The component keeps a small hand-written facade for the typed interpretation of a named setting, and codegen owns everything else. Reasoning in D3 of the task.