feat(peer)!: cut over to authenticated catalog sharing

Replace address-only trust and pushed peer state with installation identities,
SPKI-pinned QUIC, candidate-only discovery, and bounded responder-owned
protocol-8 pulls. The runtime now owns each network generation and all admitted
work through shutdown.

Add exact bundled content identities, reproducible manifest publishing,
capability-confined downloads, streaming BLAKE3 verification, quarantine and
retry, and crash-recoverable download and install transactions. Ship generated
fixture catalogs and fail closed when production manifests are absent.

The Tauri backend exposes durable sharing policy, redacted identity state, and
attempt-keyed transfer snapshots. Frontend consumption follows in the next
commit. Repository-wide test certificates and protocol-7 paths are removed.

BREAKING CHANGE: peers must use protocol 8 and exact catalog content artifacts;
protocol-7 frames and shared-certificate identities are no longer accepted.

Test Plan:
- `just test` -- passed on the completed stack (708 workspace tests)
- `just clippy` -- passed on the completed stack
- `just build` -- passed with fixture catalogs on the completed stack
- `just catalog-check-production` -- failed closed because the external
  production manifest corpus is absent
- `git diff --cached --check` -- passed

Cargo.toml

@@ -13,6 +13,7 @@ members = [
 
 [workspace.dependencies]
 base64 = "0.23"
+blake3 = "1"
 bytes = { version = "1", features = ["serde"] }
 cap-fs-ext = { version = "4", default-features = false }
 cap-primitives = "4"
@@ -24,8 +25,27 @@ if-addrs = "0.15"
 log = "0.4"
 mdns-sd = "0.20"
 mimalloc = { version = "0.1", features = ["secure"] }
-notify = "8"
-s2n-quic = { version = "1", features = ["provider-event-tracing"] }
+rcgen = {
+  version = "=0.14.8",
+  default-features = false,
+  features = ["aws_lc_rs"]
+}
+rustix = "1"
+rustls = {
+  version = "=0.23.43",
+  default-features = false,
+  features = ["aws-lc-rs", "logging", "std"]
+}
+s2n-quic = {
+  version = "=1.85.0",
+  default-features = false,
+  features = [
+    "provider-address-token-default",
+    "provider-event-tracing",
+    "provider-tls-rustls",
+  ]
+}
+s2n-quic-core = "=0.85.0"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sqlx = {
@@ -49,12 +69,14 @@ tracing = "0.1"
 tracing-log = "0.2"
 tracing-subscriber = "0.3"
 unicode-normalization = "0.1"
-uuid = { version = "1", features = ["v7"] }
 walkdir = "2"
 windows = {
   version = "0.62",
   features = [
     "Win32",
+    "Win32_Foundation",
+    "Win32_System_Registry",
+    "Win32_System_Threading",
     "Win32_UI",
     "Win32_UI_Shell",
     "Win32_UI_WindowsAndMessaging",