Tell being away from giving up

Leaving was the only way out of a network, and it is the irreversible one:
it publishes a release and then removes the configuration, the secret, the
network's signed records, its cached hints and the protocol key it used.
What somebody usually wants before a reboot, a trip or an experiment is
the other thing — stop serving it and keep everything.

`tsunagi network stop <id>` closes that network's sessions, takes its
address off the interface and keeps it from starting again. Nothing is
announced, deliberately: to the others this device is away, which is an
ordinary condition they already handle, and the address and name it holds
stay reserved for it. `tsunagi network start <id>` resumes it where it left
off. Both are remembered, so a restart does what the last instruction said
rather than what the last command line happened to say.

Except when the command line says otherwise: `up --network X` starts X
whatever its stored state, because a command naming a network is an
instruction to run it. The banner now says which of the three happened —
`new`, `already here`, or `was stopped; this command starts it` — since
silently, that is a stop that comes back from the dead with nothing to
explain it.

The listing tells the three states apart too: running with its address,
stopped and kept, or configured and waiting for an agent to start. Each row
says what to type to move it, because "stop" and "leave" are a pair that
has to be easy to tell apart before the irreversible one is typed.

The local control protocol is 11.

Covered end to end against a running agent: stopping leaves it configured
and says so, stopping twice is the state asked for rather than an error,
starting brings it back, and the secret afterwards is the one from before —
so it is the same network and not a lookalike.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -324,6 +324,8 @@ tsunagi id key rotate           replace that key
 tsunagi network                 the networks this device belongs to
 tsunagi network join -n lab -s tsn1…   join one; adds it to a running agent
 tsunagi network join -n lab     resume one this device has, or make it on the spot
+tsunagi network stop <id>       stop serving it, keeping everything
+tsunagi network start <id>      serve it again, from where it left off
 tsunagi network leave <id>      give up the address and name, then forget it
 tsunagi network secret          the secret of each joined network
 tsunagi network secret <id>     just that one, for copying
@@ -578,6 +580,23 @@ tsunagi network leave <network-id>  # give up the address and the name, then for
 tsunagi wipe --yes                  # remove everything and be a stranger again
 ```
 
+**Stopping is not leaving.** `stop` closes this network's sessions, takes
+its address off the interface and keeps it from starting again, and that is
+all: the configuration, the secret, the signed state and the protocol key
+stay exactly as they are, nothing is announced, and to the others this
+device is simply away — an ordinary condition they already handle, with its
+address and name still reserved for it. `start` picks it up where it left
+off. A network named on the `up` command line is started by that command
+whatever its stored state, and the start-up banner says so rather than
+letting a `stop` quietly come back.
+
+`leave` is the other one, and it removes, locally: the configuration and
+the secret, this network's signed records, its cached address hints and the
+protocol key it used there. What it keeps is this author's version counter
+for that network — a rejoin has to continue above the release, or every
+replica would treat the new claim as stale. Everything about *other*
+networks, and the device identity itself, is untouched.
+
 `leave` publishes a signed `Release` **first**, while the agent is running and
 its sessions are up, so the address and the name are freed for the others
 instead of staying reserved to a member that has gone. They pass the tombstone