PLUTO-529 client friction-telemetry leg: un-stub notifyFriction + wire checkRequired (post-Jul-10, server-action transport)

Deferred client leg of PLUTO-529 (server leg shipped 70df514/v2.5.0). notifyFriction currently a visual-only stub (toast.warning, NO /api POST) — decoupled by design. Post-Jul-10 (token reset), un-stub it to WRITE friction telemetry (validation-fails + user-facing feedback) at info/warn tier via a SERVER-ACTION write path (adblock-immune, posts to page URL), NOT /api. Wire the checkRequired/form-submit hook so required-field fails log. NO success logging, NO PII. This is the shared friction write path PLUTO-534 (native HTML5 invalid capture) depends on — land this first, then 534 mounts on it. HELD until after Fri Jul-10 per Elazar transport+timing decision.