refactor(peer): separate reachability from Mesh ownership

[M4n5ter]

Summary

• introduce one bounded, self-signed reachability lease as the identity-bound locator contract, independent of Peer Mesh membership
• publish that lease through authenticated Host status and consume it consistently from owner connection codes, Guest mounts, Desktop profiles, and CLI projections
• reject unsigned direct route arrays at the unpublished persistence and protocol boundaries, moving the compatibility boundary to epoch 98
• record the frozen four-layer recovery design, invariants, and acceptance criteria used by this stack

Refs #4554

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

• npm run typecheck
• npm run lint
• npm run format:check
• npm run rebuild
• npm run test:dist - all workspace tests passed
• npm run check:renderer-architecture - 71 passed
• npm run check:release - 192 passed
• git diff --check
• cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check
• cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings
• cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 27 passed
• immutable installed-CLI tarball smoke

Review focus

The lease proves who issued a bounded locator snapshot; it does not grant membership or access. Consumers still authenticate the Runtime Host and require the expected PeerId before retaining or using the lease.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes - described under Summary above
• No