feat(peer)!: cut over to authenticated catalog sharing

Replace address-only trust and pushed peer state with installation identities,
SPKI-pinned QUIC, candidate-only discovery, and bounded responder-owned
protocol-8 pulls. The runtime now owns each network generation and all admitted
work through shutdown.

Add exact bundled content identities, reproducible manifest publishing,
capability-confined downloads, streaming BLAKE3 verification, quarantine and
retry, and crash-recoverable download and install transactions. Ship generated
fixture catalogs and fail closed when production manifests are absent.

The Tauri backend exposes durable sharing policy, redacted identity state, and
attempt-keyed transfer snapshots. Frontend consumption follows in the next
commit. Repository-wide test certificates and protocol-7 paths are removed.

BREAKING CHANGE: peers must use protocol 8 and exact catalog content artifacts;
protocol-7 frames and shared-certificate identities are no longer accepted.

Test Plan:
- `just test` -- passed on the completed stack (708 workspace tests)
- `just clippy` -- passed on the completed stack
- `just build` -- passed with fixture catalogs on the completed stack
- `just catalog-check-production` -- failed closed because the external
  production manifest corpus is absent
- `git diff --cached --check` -- passed

crates/lanspread-tauri-deno-ts/src-tauri/build.rs

@@ -1,3 +1,62 @@
+use std::{env, fs};
+
+use build_support::catalog_gate::{
+    CatalogBuildMode,
+    CatalogGateInput,
+    select_catalog_build_mode,
+    validate_production_catalog,
+};
+
+mod build_support {
+    #[path = "catalog_gate.rs"]
+    pub(crate) mod catalog_gate;
+}
+
+const FIXTURE_DEVELOPMENT_ENV: &str = "LANSPREAD_USE_FIXTURE_CATALOG";
+
 fn main() {
+    println!("cargo:rerun-if-env-changed=TAURI_CONFIG");
+    println!("cargo:rerun-if-env-changed={FIXTURE_DEVELOPMENT_ENV}");
+    println!("cargo:rerun-if-changed=tauri.conf.json");
+    println!("cargo:rerun-if-changed=game.db");
+    println!("cargo:rerun-if-changed=manifests");
+
+    let mode = catalog_build_mode().unwrap_or_else(|error| {
+        panic!("catalog packaging policy failed: {error}");
+    });
+    if mode == CatalogBuildMode::Production
+        && let Err(error) = validate_production_catalog("game.db", "manifests")
+    {
+        panic!("production catalog authority gate failed: {error}");
+    }
     tauri_build::build();
 }
+
+fn catalog_build_mode() -> Result<CatalogBuildMode, Box<dyn std::error::Error>> {
+    let base_config = fs::read_to_string("tauri.conf.json")?;
+    let config_override = env::var_os("TAURI_CONFIG")
+        .map(|value| {
+            value
+                .into_string()
+                .map_err(|_| "TAURI_CONFIG is not valid UTF-8".to_owned())
+        })
+        .transpose()?;
+    let fixture_development_opt_in = match env::var_os(FIXTURE_DEVELOPMENT_ENV) {
+        None => false,
+        Some(value) if value == "1" => true,
+        Some(_) => {
+            return Err(format!("{FIXTURE_DEVELOPMENT_ENV} must be exactly 1 when set").into());
+        }
+    };
+    let cargo_profile = env::var("PROFILE").ok();
+    let out_dir = env::var_os("OUT_DIR").map(std::path::PathBuf::from);
+
+    select_catalog_build_mode(CatalogGateInput {
+        base_config: &base_config,
+        config_override: config_override.as_deref(),
+        fixture_development_opt_in,
+        cargo_profile: cargo_profile.as_deref(),
+        out_dir: out_dir.as_deref(),
+    })
+    .map_err(Into::into)
+}