feat(peer)!: cut over to authenticated catalog sharing

Replace address-only trust and pushed peer state with installation identities,
SPKI-pinned QUIC, candidate-only discovery, and bounded responder-owned
protocol-8 pulls. The runtime now owns each network generation and all admitted
work through shutdown.

Add exact bundled content identities, reproducible manifest publishing,
capability-confined downloads, streaming BLAKE3 verification, quarantine and
retry, and crash-recoverable download and install transactions. Ship generated
fixture catalogs and fail closed when production manifests are absent.

The Tauri backend exposes durable sharing policy, redacted identity state, and
attempt-keyed transfer snapshots. Frontend consumption follows in the next
commit. Repository-wide test certificates and protocol-7 paths are removed.

BREAKING CHANGE: peers must use protocol 8 and exact catalog content artifacts;
protocol-7 frames and shared-certificate identities are no longer accepted.

Test Plan:
- `just test` -- passed on the completed stack (708 workspace tests)
- `just clippy` -- passed on the completed stack
- `just build` -- passed with fixture catalogs on the completed stack
- `just catalog-check-production` -- failed closed because the external
  production manifest corpus is absent
- `git diff --cached --check` -- passed

cert.pem

@@ -1,36 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIGSzCCBDOgAwIBAgIUfYHFI/0fNNXGMwPas9U1/Ija/DEwDQYJKoZIhvcNAQEL
-BQAwgZUxCzAJBgNVBAYTAkRFMQ8wDQYDVQQIDAZCZXJsaW4xDzANBgNVBAcMBkJl
-cmxpbjESMBAGA1UECgwJUGF1bG9zb2Z0MREwDwYDVQQLDAhTb2Z0d2FyZTEkMCIG
-CSqGSIb3DQEJARYVZGRpZGRlcnJAcGF1bC5uZXR3b3JrMRcwFQYDVQQDDA5NYXN0
-ZXJEZXNhc3RlcjAeFw0yNjA1MTgxNDE2MjhaFw0zNjA1MTUxNDE2MjhaMIGVMQsw
-CQYDVQQGEwJERTEPMA0GA1UECAwGQmVybGluMQ8wDQYDVQQHDAZCZXJsaW4xEjAQ
-BgNVBAoMCVBhdWxvc29mdDERMA8GA1UECwwIU29mdHdhcmUxJDAiBgkqhkiG9w0B
-CQEWFWRkaWRkZXJyQHBhdWwubmV0d29yazEXMBUGA1UEAwwOTWFzdGVyRGVzYXN0
-ZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDJRaZ3P386Sf0O69KH
-m8UX8gBpyRObFDkXCjhSmv9vzdjcv7hCq1ZT2gdbmnEmFBi0OWp4FJt6Yn50ySdN
-9diCod3zgwa889p/eRxyy2PrQ2DA87/TsN4FudeHMRqQqKhLRdg0QSZfmHYFXVYI
-oMEKn0thqzQzMiv1DSZWqSg2iow7BSC7brRb8vSJq4z/ziXrbUODFWqjvej1Z2pu
-S3rWPQs07teWYWQzKkj8Yzk8nt2PtbS4gy0PqlSXiPAvNJ96KyT8kECFFxf6JBpa
-vLN5ny6fLZbvxQja0LpSlZsAGT1aM0XAiMM1J2EOQWt2I50Ho75jxnxfLSbVqKW4
-Ev0clRa4avUgxCUG0SiHXqEKuOdh4oCaOrxSNnAY+OUm3bepkFaxcyXa3a8vcyhJ
-hRjdQH05bAPQJd1PW+6VvEzs5YLy4PFThc+0aMsjZZWRFVOLJMDySsJitllQNewb
-vSW8tRN1mh/D/acR8TN3IzNJUCw75pFdt0NSr0vCS0BaLyoQPrVb8+DUlvFbJWlD
-bzhkMLeJw1M64jInHc4gSXFiNYzJGuDQDnz2A6ZhQvp6zh0/+7uW9y9oCt+2QfUw
-JCkLnIC7R0nbRVtnysHmouX6tcAkilZcG+eA6FHw+h9sEtiCh0ZsZZfpT0A7i7Wz
-ZMWmAe/4RhT/qfA+DlDyAp4tqwIDAQABo4GQMIGNMB0GA1UdDgQWBBQQRxB73r+0
-qF3wHT7hw7PfMWoFsDAfBgNVHSMEGDAWgBQQRxB73r+0qF3wHT7hw7PfMWoFsDAJ
-BgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYB
-BQUHAwIwFAYDVR0RBA0wC4IJbG9jYWxob3N0MA0GCSqGSIb3DQEBCwUAA4ICAQDB
-ANotdXwIls3X2SY3Sfb5EN7Q/r5Gow96STnM0HBRFeGLeSOrndHVYQsLRxtEeV54
-nJee14g4FCHIBzdsFvk1nbWAqnSwBzPE0KHIXTivC4E+p0hPlJ771qTVFoz6yPKf
-WmH9YIDQGiCB5QhQ6MYYsfXXXGFMbWVWVFrn1IAbmPRxECxb3OT8TJCeo+jyPekt
-iQEXngy/8Vp/Q4SAFL8FIU9fipRG10KnKCM3J1mlNJvFLvwzocBc+S9ebYO7oY+0
-aOamI87FNCuuwe/bHEyaWMI6LzkhOQdnA0nsmJGbn9rwc2iAlJfPjRAAf+lttZfC
-/E76/SY8DCwPtSDfIJPK59u2EIwW+zgG5hPc90DAJS9QserRIp8DGvnaOPvO3CH7
-fEadQ9FyJVfwR+V1OJuMTo+8yzrsBq3BEPVSUvzFZe8GNWox3XihEJTcNASIHNj7
-jZvthkYpag82zJu+Fj4LG4Q/Y4XMIOkd7gRJDqkXsZCBtRMN2z47MU66cw0Nb/v5
-BB7RF8WlTbF0y5uFIGyVb+vL10HwNE7SK4EiJElTyxWUkX9GJpgNg4hEEbK+K7DE
-+94AhcQu/Eu0RjaZlLJTWkuiS7krw2Mh93IMBlLiVLcGBvZFT8K/G7kuJSQeHbz2
-9pPEm5F7Qb6r30372RPamaEtWnWneZ5sTNPbKkjS+w==
------END CERTIFICATE-----