Add tsunagi status over a local control socket

There was no way to ask a running agent what it was doing; the only status
came from the periodic print of the `up` process itself.

The new ipc module is an adapter over the public API: nothing in the agent
core knows it exists, so a Windows named pipe or an authenticated loopback
socket can be added beside it. It is also a different interface from the
peer-to-peer protocol — between processes on one machine, authorised by
filesystem permissions rather than the network secret. The socket is 0600
inside an owner-only directory, the wire format is length-prefixed postcard
with the same bounds the network protocol uses, and the report types are
their own stable format rather than the crate's internals.

The socket path is derived from the state directory into XDG_RUNTIME_DIR
when there is one. A Unix socket address is limited to about 100 bytes, and
a deeply nested state directory overflows it — which is exactly what
happened on the first attempt.

Two presentation fixes while here. Multicast is counted separately from
unroutable traffic, because Linux emits multicast on every IPv6 interface
and it was showing up as "packets for unknown addresses" on a healthy
agent. And WireGuard protocol errors are no longer added into the dropped
counter: a few are normal while both ends start a handshake at once, and a
working tunnel was reporting "dropped 3" with no traffic at all.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lib.rs

@@ -14,7 +14,10 @@
 //! * [`proto`] — the control protocol: framing, messages, handshake.
 //! * [`net`] — the iroh connectivity adapter and its observability surface.
 //! * [`agent`] — the runtime: agent lifecycle, per-network runtimes, reconnect.
-//! * [`dataplane`] — the minimal contract future IP plugins must satisfy.
+//! * [`dataplane`] — the contract IP plugins satisfy, the packet transport,
+//!   and the WireGuard data plane.
+//! * [`ipc`] — the local control interface a command line tool talks to. An
+//!   adapter over the public API; the core does not know it exists.
 //!
 //! # What this library deliberately does not do
 //!
@@ -36,6 +39,7 @@ pub mod dataplane;
 pub mod discovery;
 pub mod error;
 pub mod identity;
+pub mod ipc;
 pub mod net;
 pub mod proto;
 pub mod storage;