feat(peer)!: cut over to authenticated catalog sharing

Replace address-only trust and pushed peer state with installation identities,
SPKI-pinned QUIC, candidate-only discovery, and bounded responder-owned
protocol-8 pulls. The runtime now owns each network generation and all admitted
work through shutdown.

Add exact bundled content identities, reproducible manifest publishing,
capability-confined downloads, streaming BLAKE3 verification, quarantine and
retry, and crash-recoverable download and install transactions. Ship generated
fixture catalogs and fail closed when production manifests are absent.

The Tauri backend exposes durable sharing policy, redacted identity state, and
attempt-keyed transfer snapshots. Frontend consumption follows in the next
commit. Repository-wide test certificates and protocol-7 paths are removed.

BREAKING CHANGE: peers must use protocol 8 and exact catalog content artifacts;
protocol-7 frames and shared-certificate identities are no longer accepted.

Test Plan:
- `just test` -- passed on the completed stack (708 workspace tests)
- `just clippy` -- passed on the completed stack
- `just build` -- passed with fixture catalogs on the completed stack
- `just catalog-check-production` -- failed closed because the external
  production manifest corpus is absent
- `git diff --cached --check` -- passed

crates/lanspread-peer-cli/catalogs/multi/manifests/cnctw.json

@@ -0,0 +1,50 @@
+{
+  "schema_version": 1,
+  "game_id": "cnctw",
+  "game_version": "20160128",
+  "chunk_size": 134217728,
+  "files": [
+    {
+      "canonical_path": "a-first.eti",
+      "kind": "file",
+      "size": 103,
+      "file_blake3": "a67333b9f370ff284a41e8c4af1a74881a46c32fe7bee77c70230c6b0fb53a6e",
+      "chunk_blake3": [
+        "a67333b9f370ff284a41e8c4af1a74881a46c32fe7bee77c70230c6b0fb53a6e"
+      ]
+    },
+    {
+      "canonical_path": "version.ini",
+      "kind": "file",
+      "size": 8,
+      "file_blake3": "995b0db832e29dbb6025f31b7aa8f1e842151971fac3ea7d6cac2c287f2ce64a",
+      "chunk_blake3": [
+        "995b0db832e29dbb6025f31b7aa8f1e842151971fac3ea7d6cac2c287f2ce64a"
+      ]
+    },
+    {
+      "canonical_path": "z-second.eti",
+      "kind": "file",
+      "size": 105,
+      "file_blake3": "465e3bf1e077a114422a75095271072627b9a9aaf7e72ae7c9661f9ac972ccaf",
+      "chunk_blake3": [
+        "465e3bf1e077a114422a75095271072627b9a9aaf7e72ae7c9661f9ac972ccaf"
+      ]
+    }
+  ],
+  "streamed_install_files": [
+    {
+      "canonical_path": "order/first.txt",
+      "kind": "file",
+      "size": 22,
+      "file_blake3": "f0440582fb0af9b05a9755bf5764127ecc09a0f57aa267599770cbec189ebb54"
+    },
+    {
+      "canonical_path": "order/second.txt",
+      "kind": "file",
+      "size": 23,
+      "file_blake3": "b931fd872258655d87983bdc7d56bc94d30b31046c4184487121bc3e012330e5"
+    }
+  ],
+  "content_id": "629012cd3c4a2f7bcbc3d1f40bf111381cd08b98ffb571747623e3912b586344"
+}