Implement fast userspace multihop mesh routing

Replace the one-intermediate-peer relay with protocol-scoped connectivity
graphs and precomputed shortest-path/ECMP forwarding snapshots. Independent
transport readers forward opaque transit frames without a plugin or TUN
round trip. Carry source, destination, a bounded hop limit and stable flow
tags; preserve end-to-end WireGuard links across topology changes.

Classify IP flows before encryption and preserve their tags through the
WireGuard pending queue. Add offline four-agent path-change coverage, loop
and isolation tests, and an opt-in release forwarding microbenchmark. Bump
control/data ALPNs while preserving persistent network identities and state.

Also include the pending Windows Mainline idle-timeout fix and its regression
test, using a reproducible vendored dependency patch.

Validation: fmt, workspace Clippy with warnings denied, and 307 release tests
passed. Two pre-existing Windows SQLite wipe failures were excluded; public
DHT and the manual benchmark remain ignored by default. The forwarding
microbenchmark measured 103 ns (64 B) and 202 ns (1280 B) per transit packet,
excluding encryption and socket I/O.

docs/protocol.md

@@ -9,7 +9,7 @@ Two versions exist and are independent:
 
 - **Identity scheme**, `tsunagi-network-id-v1`. Frozen. Changing it creates a
   different network space for the same name and secret.
-- **Control protocol**, ALPN `tsunagi/ctrl/1`, `PROTOCOL_VERSION = 1`.
+- **Control protocol**, ALPN `tsunagi/ctrl/2`, `PROTOCOL_VERSION = 2`.
 
 Upgrading the crate or bumping the control protocol must never change an
 existing `NetworkId`.
@@ -135,7 +135,7 @@ event does not report a network id.
 ## The data plane protocol
 
 IP plugin packets never travel on a control connection. They use their own
-ALPN, `tsunagi/data/3`, on their own iroh connection:
+ALPN, `tsunagi/data/4`, on their own iroh connection:
 
 ```text
 initiator -> responder : (the same membership handshake as above)
@@ -172,9 +172,35 @@ holding up subsequent packets. Packet IDs are scoped to a QUIC connection;
 reassembly is created only after the membership handshake. All limits live in
 `config.rs`. There is no transport-layer retransmission added by this framing.
 
-Version 3 is incompatible with previous data ALPNs. Upgrade both endpoints
-and intermediate peers together. The control protocol, network secret,
-device identity and stored network configuration are unchanged.
+Version 4 adds a routing envelope inside the transport fragmentation framing:
+
+| field | bytes | encoding |
+|---|---:|---|
+| envelope version | 1 | `1` |
+| remaining hops | 1 | initially `16`; transit decrements, drops at `1` |
+| source peer | 32 | original endpoint public key |
+| destination peer | 32 | final endpoint public key |
+| flow id | 8 | big endian opaque stable hash supplied by the plugin |
+| payload | remaining | end-to-end encrypted plugin bytes |
+
+The fixed header is 74 bytes. Zero/oversized hop limits, unknown versions,
+short frames, oversized datagrams and unknown sources are rejected. A frame
+addressed here is delivered to its source's protocol inbox; transit goes straight
+to its next transport. The network and protocol are bound to the authenticated
+transport connection, not supplied by the frame. Intermediate nodes cannot
+decrypt or authenticate the inner WireGuard payload; the destination does that.
+Flow ids are routing hints, not authorization proofs.
+
+Control ALPN 2 carries `Reachable { links: [{ peer, protocol }] }`. Each row
+belongs to the authenticated sender and is replaced atomically, expires after
+90 seconds, and is withdrawn on session closure. Only compatible authenticated
+members enter a protocol's graph; local edges always come from actual links.
+Announcements refresh on the existing control maintenance interval and are
+sent immediately on link changes. Topology stays volatile, outside signed state.
+
+Upgrade both endpoints and intermediate peers together. Older control and data
+ALPNs cannot interoperate. The network secret, device identity, identity
+derivation, transcript encoding and stored network configuration are unchanged.
 
 Separate connections mean separate congestion control, so a saturated data
 plane cannot delay control messages, and a data plane failure cannot take the
@@ -193,6 +219,8 @@ not affect other networks.
 | `Ping { seq, payload }` | small request used to verify the exchange |
 | `Pong { seq, payload }` | the echoed reply |
 | `State { records }` | a snapshot of signed records, merged into what the receiver holds |
+| `Peers { peers }` | unverified member address hints, requiring their own handshake |
+| `Reachable { links }` | sender's current direct data links, scoped by protocol |
 | `Bye { reason }` | graceful goodbye; not a revocation of anything |
 
 A `State` snapshot is merged, never substituted: an author missing from it is