feat(peer)!: cut over to authenticated catalog sharing

Replace address-only trust and pushed peer state with installation identities,
SPKI-pinned QUIC, candidate-only discovery, and bounded responder-owned
protocol-8 pulls. The runtime now owns each network generation and all admitted
work through shutdown.

Add exact bundled content identities, reproducible manifest publishing,
capability-confined downloads, streaming BLAKE3 verification, quarantine and
retry, and crash-recoverable download and install transactions. Ship generated
fixture catalogs and fail closed when production manifests are absent.

The Tauri backend exposes durable sharing policy, redacted identity state, and
attempt-keyed transfer snapshots. Frontend consumption follows in the next
commit. Repository-wide test certificates and protocol-7 paths are removed.

BREAKING CHANGE: peers must use protocol 8 and exact catalog content artifacts;
protocol-7 frames and shared-certificate identities are no longer accepted.

Test Plan:
- `just test` -- passed on the completed stack (708 workspace tests)
- `just clippy` -- passed on the completed stack
- `just build` -- passed with fixture catalogs on the completed stack
- `just catalog-check-production` -- failed closed because the external
  production manifest corpus is absent
- `git diff --cached --check` -- passed

crates/lanspread-peer/Cargo.toml

@@ -13,6 +13,8 @@ lanspread-proto = { path = "../lanspread-proto" }
 lanspread-utils = { path = "../lanspread-utils" }
 
 # external
+base64 = { workspace = true }
+blake3 = { workspace = true }
 bytes = { workspace = true }
 cap-fs-ext = { workspace = true }
 cap-primitives = { workspace = true }
@@ -22,17 +24,21 @@ futures = { workspace = true }
 gethostname = { workspace = true }
 if-addrs = { workspace = true }
 log = { workspace = true }
-notify = { workspace = true }
+rcgen = { workspace = true }
+rustls = { workspace = true }
 s2n-quic = { workspace = true }
+s2n-quic-core = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 strum = { workspace = true }
 tokio = { workspace = true }
 tokio-util = { workspace = true }
 unicode-normalization = { workspace = true }
-uuid = { workspace = true }
 walkdir = { workspace = true }
 
+[dev-dependencies]
+tokio = { workspace = true, features = ["test-util"] }
+
 [lints.clippy]
 pedantic = { level = "warn", priority = -1 }
 todo = "warn"