feat(cli+mcp): surface direct-dial through amesh send / mesh_request (follow-up to #29) — de-flake the mDNS round-trip tests

[hartsock]

Context

The bus-level direct-dial primitive already landed under #29:
Bus::request_direct(PeerEndpoint, …) / publish_to_direct(…) dial a known
(agent_pubkey, SocketAddr) and skip mDNS entirely (covered by
request_reply_roundtrip_via_direct_dial_no_mdns, which is CI-green real-QUIC
over loopback). But that primitive is not reachable from either user-facing
surface:

• amesh send (agent-mesh-cli/src/send.rs) resolves the peer via
  PeerResolver (mDNS multicast) — there is no way to pass an address.
• amesh mcp's mesh_request (agent-mesh-cli/src/mcp.rs,
  tool_request) calls bus.request(peer_fp, …) (the resolve path); the
  request_direct primitive is dead code from the CLI's point of view.
• amesh listen (agent-mesh-cli/src/listen.rs) prints agent_fp and the
  bound udp/<port> but not the agent_pubkey. Dialing directly needs the
  raw 32-byte pubkey (fingerprint = blake3(pubkey) is not reversible), so a
  peer running amesh listen today doesn't even emit what a direct dialer
  needs.

Why this matters (the payoff)

Four integration tests are currently #[ignore]d because they depend on mDNS
multicast, which is unreliable on hosted CI runners (they time out, having
raced a discovery deadline that never resolves). They were de-flaked by tiering
them to a real-LAN --ignored tier:

• agent-mesh-bus/tests/bus_roundtrip.rs: request_reply_roundtrip,
  reply_reaches_quiet_asker_via_dial_back
• agent-mesh-cli/tests/cli.rs: listen_send_roundtrip_delivers_payload_before_sender_exits
• agent-mesh-cli/tests/mcp_stdio.rs: mcp_server_round_trips_request_to_live_responder

Tiering keeps main green but leaves the CLI/MCP request path with no
per-PR CI coverage at all — the only reason those tests need multicast is
that the CLI has no address-addressed dial. Surfacing direct-dial lets the
send/listen/mesh_request round-trips run over real QUIC on loopback with
no multicast, exactly like the bus's own …_via_direct_dial_no_mdns test —
deterministic, and safe to un-#[ignore] on hosted CI.

Scope

1. amesh listen — also print agent_pubkey=<64-hex> (the one datum a
   direct dialer is missing). Pure additive output.
2. amesh send — add --addr <ip:port> + --pubkey <64-hex>. When
   --addr is given, skip the resolver and dial the endpoint directly
   (mirroring send.rs's existing dial, minus discovery). Validation: --addr
   requires --pubkey; if the positional fingerprint is also supplied, assert
   blake3(pubkey) == fingerprint (the fingerprint becomes a checksum on the
   pubkey).
3. amesh mcp mesh_request — accept optional addr + pubkey arguments;
   when both present, route via bus.request_direct(PeerEndpoint::new(pubkey, addr), …) instead of resolve_peer + bus.request. peer becomes optional
   in that mode.
4. De-flake: replace the two ignored CLI/MCP mDNS tests with deterministic
   direct-addr equivalents (real QUIC, loopback, no multicast), un-#[ignore]d
   and gating every PR. The two bus mDNS tests stay #[ignore]d — they
   uniquely exercise multicast discovery, which genuinely can't be tested
   without a LAN.
5. Housekeeping: repoint the dangling (#166) tiering references (there is
   no issue #166 — introduced in error by refactor(bus): Transport seam — deterministic in-memory request/reply tests (#166) #50/test(cli): tier the mcp_stdio mDNS round-trip to the real-LAN tier (#166) #51) at this issue.

Out of scope

• A discovery-free publish CLI verb (publish_to_direct surfacing) — separate
  follow-up if wanted.
• Any change to the mDNS discovery path itself; amesh peers / resolve-mode
  send stay as-is.
• The newt worker --persona headless work (tracked elsewhere).

Acceptance

• amesh listen output includes the agent pubkey.
• amesh send --addr … --pubkey … --payload … round-trips to a loopback
  amesh listen with no mDNS, asserted by a non-ignored CLI test.
• amesh mcp mesh_request with addr+pubkey round-trips to an in-process
  responder with no mDNS, asserted by a non-ignored mcp_stdio test.
• No #[ignore]d test on the per-PR critical path depends on multicast for the
  CLI/MCP request surface.