fix(nat): honest reachability detection + v0.2.4

[ForeverInLaw]

Ships the Moss NAT-detection fix as v0.2.4 (Moss runtime → v0.3.1).

Root cause

applyExternalObservation marked a node Public + PublicReachable=true from a single reflexive address and skipped the inbound probe. Behind any NAT the reflexive address is just the NAT's WAN IP, so every NATed node self-reported "open" → futile direct dials → peer flapping (peer_joined/peer_left).

Fix (redstone-md/moss v0.3.1, commit 987e2fd)

• Keep tentative Public type but leave PublicReachable to an actual inbound probe (confirmReachability).
• Multi-destination binding observations now downgrade to symmetric_nat when the mapped port varies.
• New mesh-level tests; full moss Go suite green.

mosh

• Submodule re-pinned to moss 987e2fd, moss.config.json → v0.3.1.
• Version → 0.2.4, CHANGELOG.

Known limit: two peers both behind symmetric NAT still need a relay/supernode; honest detection just stops the futile direct-dial loop.

🤖 Generated with Claude Code