fix: connect pinned geo-relay selection to daemon routing

[tcballard]

Problem

#18's selector existed only as library code. The daemon used fixed relay lists and did not expose the selector's snapshot hashes.

Changes

• Add explicit geo_relays configuration with supplement/replace semantics; omission preserves existing fixed-relay behaviour.
• Run separate per-geohash pools with at most eight cells and ten endpoints per cell. Geographic sends and subscriptions use only their own pool; inbound filtering rejects other cells, ambiguous geohash tags and private mail.
• Re-evaluate observed connection health every 30 seconds, exclude failed candidates for five minutes and never escape a replace-only policy.
• Report exact profile/hashes, requested/active cells, selected endpoints and bounded failure diagnostics through daemon/ctl status.
• Wire join/leave, joined-cell reload, process shutdown and panic; document policy restart requirements and truthful pool-versus-connectivity status.
• No added dependencies or lockfile changes.

Fixes #18 when merged after verification.

Validation

• Pinned Rust 1.98.0 formatting and workspace Clippy with warnings denied pass.
• New daemon tests pass for configuration/TLS rejection, exact status metadata, separate cell routing, leave removal, panic cleanup and actual periodic failed-endpoint removal.
• Incoming cell/private-mail filter regression passes.
• Packaging/man checks and release-size guard regression tests pass.
• Full local workspace testing stops at unchanged second_server_cannot_replace_a_live_ipc_endpoint: the first bind returns Operation not permitted in this runtime. This is recorded as a failure, not a passing suite; CI must validate the full suite.
• Local documentation, debug/release builds and version checks pass. Aggregate release binary size is 6,117,280 bytes (5.83 MiB), below the 10 MiB ceiling.
• GitHub CI passes all jobs, including the full test suite, dependency policy/audit, release-size budget and packaging checks.
• Relay interoperability passes both Grain blackbox and relay29 NIP29 jobs.

No real-phone, Omarchy desktop, public-relay interoperability or Tor qualification is claimed. Contributor PRs #224/#226 are not included; this PR does not merge either one.