ensemble: bound every send, order the opening frame, prune dead routes

[adiled]

Follows #61. That PR landed a fault model and an honest message identity; this one closes the failure modes it left open.

Sends all have deadlines

Liveness pongs, Kademlia queries and kad_find wrote without a bound. The opening hello was worse — awaited raw inside a spawned task, so a peer that never read left that task hung forever with the gate shut behind it and every later send parked. Now bounded, and a stalled opening closes the link instead of leaking.

Fanout for publish, gossip and probes was serial, so wall time was the sum of the peers. Now the slowest peer. a_fanout_costs_the_slowest_peer_not_the_sum pins it.

The opening frame lands first

install spawned the hello and raced application traffic onto the same link — a routed tone could reach the wire before the frame that authenticates the peer. A Gate parks every send until the opening frame has landed.

The test is pinned to the bug, not to the fix. Remove the gate and it fails:

left: String("prompt")
right: "hello"

Three defects found while writing it:

• Default produced a permanently-shut gate (Mutex<bool> defaults false).
• wait() checked the flag then parked, so an opened() in that window was lost forever. Fixed by registering with Notify before reading the flag via Notified::enable().
• opened() resurrected an already-shut gate.

Identity

No tone publishes before its link completes the signed hello; drops are counted in tones_before_handshake(). strict_auth now defaults to true, so an unsigned peer is refused unless a caller explicitly waives it.

from is deliberately left unvalidated. This branch first enforced from == transport_peer for tones addressed to us. sim proved it wrong: from names the originator — often a nestler, not a humd — and the mesh relays addressed tones, so the check rejected legitimate fan-out. Retracted rather than papered over.

Routing

A removed peer is forgotten from every bucket instead of staying addressable forever, and the table is persisted to state_dir()/routing.json so a restart resumes it. Restore is versioned and a corrupt file yields an empty table rather than a panic.

Framing

TCP, TLS and iroh now share one NDJSON codec with a 256KiB frame ceiling. An oversize frame is discarded and the stream resyncs on the next newline instead of growing without bound.

CI

New mesh job: clippy gate plus the ensemble/sim/humd suites — 209 tests, which nothing ran before.

The cargo fmt --check gate was deliberately not added: HEAD is 567 hunks off rustfmt-clean, so it would be red on arrival and stay that way. Making the repo fmt-clean is its own change. For the same reason this branch carries no formatting churn — 21 files, all substance.

Verification

cargo clippy -p ensemble -p hum-paths --all-targets -- -D warnings -A clippy::type_complexity
cargo test --locked -p ensemble -p sim -p humd -p hum -p humctl
# 32 suites, 209 passed, 0 failed