feat(peer)!: cut over to authenticated catalog sharing

Replace address-only trust and pushed peer state with installation identities,
SPKI-pinned QUIC, candidate-only discovery, and bounded responder-owned
protocol-8 pulls. The runtime now owns each network generation and all admitted
work through shutdown.

Add exact bundled content identities, reproducible manifest publishing,
capability-confined downloads, streaming BLAKE3 verification, quarantine and
retry, and crash-recoverable download and install transactions. Ship generated
fixture catalogs and fail closed when production manifests are absent.

The Tauri backend exposes durable sharing policy, redacted identity state, and
attempt-keyed transfer snapshots. Frontend consumption follows in the next
commit. Repository-wide test certificates and protocol-7 paths are removed.

BREAKING CHANGE: peers must use protocol 8 and exact catalog content artifacts;
protocol-7 frames and shared-certificate identities are no longer accepted.

Test Plan:
- `just test` -- passed on the completed stack (708 workspace tests)
- `just clippy` -- passed on the completed stack
- `just build` -- passed with fixture catalogs on the completed stack
- `just catalog-check-production` -- failed closed because the external
  production manifest corpus is absent
- `git diff --cached --check` -- passed

crates/lanspread-peer-cli/catalogs/default/manifests/alienswarm.json

@@ -0,0 +1,62 @@
+{
+  "schema_version": 1,
+  "game_id": "alienswarm",
+  "game_version": "20190317",
+  "chunk_size": 134217728,
+  "files": [
+    {
+      "canonical_path": "alienswarm.eti",
+      "kind": "file",
+      "size": 125829913,
+      "file_blake3": "77fd653681a1643973dd59b981417eed231304d1f785b1b529c1c28ce94d0a5b",
+      "chunk_blake3": [
+        "77fd653681a1643973dd59b981417eed231304d1f785b1b529c1c28ce94d0a5b"
+      ]
+    },
+    {
+      "canonical_path": "notes.txt",
+      "kind": "file",
+      "size": 34,
+      "file_blake3": "9a2cbf6fa18632be6e6262671952f781a3b53f41c3ca31219b7e19763d40a65e",
+      "chunk_blake3": [
+        "9a2cbf6fa18632be6e6262671952f781a3b53f41c3ca31219b7e19763d40a65e"
+      ]
+    },
+    {
+      "canonical_path": "version.ini",
+      "kind": "file",
+      "size": 8,
+      "file_blake3": "813c1bf52f38019051bfbc2cbfcdbf8620a46124ddb14dc7a55df9daa6186bee",
+      "chunk_blake3": [
+        "813c1bf52f38019051bfbc2cbfcdbf8620a46124ddb14dc7a55df9daa6186bee"
+      ]
+    }
+  ],
+  "streamed_install_files": [
+    {
+      "canonical_path": "target/peer-cli-large-fixture/alienswarm-payload",
+      "kind": "directory",
+      "size": 0,
+      "file_blake3": null
+    },
+    {
+      "canonical_path": "target/peer-cli-large-fixture/alienswarm-payload/payload-a.bin",
+      "kind": "file",
+      "size": 41943040,
+      "file_blake3": "d9d3cd4605ec26ada09b3e618546c45dfd8b7dd42ba7d1e825cff3062037cedf"
+    },
+    {
+      "canonical_path": "target/peer-cli-large-fixture/alienswarm-payload/payload-b.bin",
+      "kind": "file",
+      "size": 41943040,
+      "file_blake3": "3835c341be211b8549328f31b82732b88e47e18db4748e296b9e3fdbad339c07"
+    },
+    {
+      "canonical_path": "target/peer-cli-large-fixture/alienswarm-payload/payload-c.bin",
+      "kind": "file",
+      "size": 41943040,
+      "file_blake3": "4ba18b14e0ba7e5822aa1c8d494a1646b82f53581f65217bb6dcee3f69e7ba7d"
+    }
+  ],
+  "content_id": "e871472e2dc154623369c7a05825d65f50f1412509569dab0d15c4565489dcfc"
+}