fix(bus): dial replies over a candidate set, drop scopeless link-local (#61)

[hartsock]

What this PR does

Fixes the scopeless link-local dial-back bug (#61) by retiring the
single-address reply route from #21 in favour of fingerprint-keyed
candidate resolution — the shape docs/decisions/floating_identity.md
mandates (locations are candidates, never load-bearing).

• reply_dial_candidates(source) — builds the reply dial set: the recv
  source path (its recvmsg scope id already intact) plus same-host
  v4/v6 loopback at the source port. Never a single load-bearing address;
  never empty for a same-host peer. dial_reply_peer now dials this set
  (iroh races the paths) instead of endpoint.dial(pubkey, [one_addr]).
• is_scopeless_link_local(addr) — fe80::/10 with scope_id == 0.
  Such an address is undialable and, left in an iroh dial set, fails
  sendmsg with InvalidInput, aborting the whole race. Filtered out at
  both dial sites (the reply path and the mDNS dial_peer set), so
  the scopeless fe80:: that mDNS surfaces can no longer poison the dial.
  Hand-rolled because Ipv6Addr::is_unicast_link_local is unstable on
  our MSRV (1.75).

Why a quiet-bind peer was affected: announce:false makes it
mDNS-invisible, so dial-back was its only route — the single scopeless
address was a true single point of failure. Loopback keeps the set
non-empty, so its identity stays reachable same-host.

Spike that de-risked the fix

Traced iroh 0.98.2: an inbound datagram's source scope id is
preserved end-to-end — noq-udp decode_recv reads sin6_scope_id
(unix.rs), MultipathMappedAddr::Ip keeps the full SocketAddr, and
Incoming::remote_addr() returns it verbatim. So the recv source path is
dialable as-is; the scopeless fe80:: poison enters via mDNS
records (which carry no scope), which is why the filter lives at the
candidate-set layer, not the recv-capture layer. No upstream iroh change
needed.

Test plan

• New pure, deterministic unit tests in agent-mesh-bus/src/bus.rs
  (gate every PR):
  • scopeless_link_local_source_dropped_loopback_survives — the bus: reply dial-back to a scopeless link-local IPv6 source fails; quiet-bind clients become unreachable #61
    regression: scopeless fe80:: source → set drops it, keeps both
    loopbacks, never empty. Verified RED against a single-address stub
    before the fix.
  • scoped_link_local_source_is_kept — a fe80::%N source (real scope)
    stays a candidate.
  • routable_source_yields_source_plus_loopback — source + both
    loopbacks; length ≥ 2 (never one address). Uses RFC 5737 TEST-NET-1.
  • loopback_source_not_duplicated — dedup.
  • scopeless_link_local_predicate_boundaries — fe80::/10 edges,
    scoped vs scopeless, loopback/global/IPv4/fec0:: negatives.
• just check clean: cargo fmt --check, clippy --workspace --all-targets -D warnings (zero warnings), cargo test --workspace
  (all suites green; agent-mesh-bus lib 54 passed).
• just cov-ci passes the 75% floor (line coverage clears it even with
  the excluded pyo3 modules counted).

Out of scope

• Real dial-back-over-iroh integration proof. Stays #[ignore]d on
  the real-LAN tier (per the repo's existing convention that real-mDNS
  round-trips are flaky on hosted CI); the deterministic unit tests above
  are the per-PR gate.
• Downstream test tiering. newt-mesh's
  quiet_client_gets_replies_via_dial_back is being split into a mocked
  per-PR unit tier + a live iroh smoke lane under newt-agent#1190;
  this fix greens that smoke lane at the source. Separate repo, separate
  PR.
• Cross-host scopeless link-local. Genuinely unroutable without an
  interface; cross-host peers announce routable addrs over mDNS, so this
  is not a regression.

Fixes #61. Supersedes the #62 WIP handoff (close #62 when this lands).

Stacked on docs/floating-identity (the doctrine this implements);
retarget to main once that base merges.