feat(peer)!: cut over to authenticated catalog sharing

Replace address-only trust and pushed peer state with installation identities,
SPKI-pinned QUIC, candidate-only discovery, and bounded responder-owned
protocol-8 pulls. The runtime now owns each network generation and all admitted
work through shutdown.

Add exact bundled content identities, reproducible manifest publishing,
capability-confined downloads, streaming BLAKE3 verification, quarantine and
retry, and crash-recoverable download and install transactions. Ship generated
fixture catalogs and fail closed when production manifests are absent.

The Tauri backend exposes durable sharing policy, redacted identity state, and
attempt-keyed transfer snapshots. Frontend consumption follows in the next
commit. Repository-wide test certificates and protocol-7 paths are removed.

BREAKING CHANGE: peers must use protocol 8 and exact catalog content artifacts;
protocol-7 frames and shared-certificate identities are no longer accepted.

Test Plan:
- `just test` -- passed on the completed stack (708 workspace tests)
- `just clippy` -- passed on the completed stack
- `just build` -- passed with fixture catalogs on the completed stack
- `just catalog-check-production` -- failed closed because the external
  production manifest corpus is absent
- `git diff --cached --check` -- passed

crates/lanspread-peer/src/services.rs

@@ -9,11 +9,21 @@ mod discovery;
 mod handshake;
 mod liveness;
 mod local_monitor;
+mod remote_state;
 mod server;
+mod state_sync;
 mod stream;
+mod transfer;
 
 pub use discovery::run_peer_discovery;
-pub(crate) use handshake::{HandshakeCtx, perform_handshake_with_peer};
+pub(crate) use handshake::{
+    HandshakeCtx,
+    PeerRefreshOutcome,
+    ReservedCandidateHandshake,
+    perform_peer_refresh,
+};
 pub use liveness::run_ping_service;
 pub use local_monitor::run_local_game_monitor;
+pub(crate) use remote_state::clear_remote_state_and_publish;
 pub use server::run_server_component;
+pub(crate) use state_sync::StateSyncHandle;