feat(peer): recover live routes in one connection attempt

[M4n5ter]

Summary

• let one identity-bound native connection attempt consume complete live candidate snapshots instead of timing out and restarting around stale invitation routes
• start immediate dialing and route observation concurrently, then wake the same reconnect lifecycle when Mesh evidence, native connectivity, or system resume produces a usable path
• persist and rotate signed reachability leases in direct profiles, owner connection codes, and Guest mounts; copied raw route arrays are no longer a second recovery authority
• keep Session Guest readiness behind authenticated Host status and transcript catch-up while reusing the established peer connection for the second authorization phase
• bound peer-keyed recovery history by time, active ownership, and capacity
• remove the unpublished CLI path that created durable direct profiles from unverified PeerIds and route hints

Closes #4554

Verification

Verified on the complete stacked head after rebasing from main at eacfb46aa7ec93273bf468335f4270bba62d35a5:

• npm run typecheck

• npm run lint

• npm run format:check

• npm run rebuild

• npm run test:dist - all workspace tests passed

• npm run check:renderer-architecture - 71 passed

• npm run check:release - 192 passed

• git diff --check

• cargo fmt --manifest-path native/runtime-host-peer/Cargo.toml -- --check

• cargo clippy --locked --all-targets --manifest-path native/runtime-host-peer/Cargo.toml -- -D warnings

• cargo test --locked --manifest-path native/runtime-host-peer/Cargo.toml - 28 passed

• immutable installed-CLI tarball smoke

• focused native client and Peer Mesh recovery suites - 27 passed

Review focus

Candidate changes are evidence for one immutable (expected PeerId, deadline) attempt, not permission to restart work or switch identities. TypeScript supplies authenticated candidate snapshots; the native engine remains the sole dial and race authority.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and verified the change under maintainer direction.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes - described under Summary above
• No

[jackwener]

Approved at exact head cdc82727f889e356802dc992cef5d9d73fc89a82 at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

---

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.