feat: publish deterministic sometimes-state census

[wallstop]

Summary

• add five fixed-order, monotonic production observations and include their final per-peer/aggregate vectors in deterministic simulation trace identity
• publish strictly validated, atomically written, domain-separated organic and targeted census artifacts from the unchanged nightly fleet
• add real production-path positives, adjacent negatives, replay/zero controls, mutation-sensitive artifact tests, and the merge/upload workflow
• refresh all currently compatible Cargo/tool/action pins, including Rust nightly 2026-08-26, Codex, Ruff, Vale, and CI actions

Acceptance evidence

• final adversarial review: zero Critical/High/Medium/Low findings
• full workspace Clippy with tokio,json: pass
• workspace/all-target Nextest: 3,082 passed, 72 skipped
• cargo c: pass; cargo t: 2,975 passed, 72 skipped
• pinned two-seed Miri matrix: 3,306 passed, 10 ignored
• workflow/static tests: 179 passed; Actionlint and all four audit/deny matrices pass
• public API census: 2,716 symbols match
• exact nightly seed-316 run: 1,000 schedules / 5,000,000 steps; nine JSON artifacts totaling 9,154 bytes
• warmed interleaved B/T ratios: 101.9491%, 101.1156%, 103.2193%; median ratio 101.6623% (limits: 115% paired, 110% median)

The initial nightly intentionally reports organic zeroes without failing. A future seven-window ratchet remains a separately approved decision.

Closes #316

---

Note

Medium Risk
Touches P2P confirmation folding and rollback observation hooks on hot paths, but bits are observation-only; larger risk is CI/nightly census workflow and toolchain bumps affecting reproducibility and security gates.

Overview
Adds issue #316 observation plumbing: five fixed-order, monotonic “sometimes-state” bits are recorded on the production P2P path (rollback depth at prediction limit, relay lower-floor consumption, connect-status nudge queued, sparse earlier rollback checkpoint, input ring one slot below capacity) and exposed via doc-hidden P2PSession::diagnostic_sometimes_state_vector without changing wire, RNG, or replay semantics.

The simulation harness schema 20 folds per-peer and aggregated vectors into deterministic trace identity; nightly fleet runs write eight organic shards plus targeted probe evidence under FORTRESS_SIM_CENSUS_DIR, then CI merges, validates, and uploads published census artifacts (separate from failure dumps).

CI/tooling moves the pinned Rust nightly to 2026-08-26, bumps Vale, Ruff, typos, actions/cache v6, taiki-e/install-action, checkout patches, and adds a cargo deny license-check flag-order compatibility branch with workflow contract tests.

^{Reviewed by Cursor Bugbot for commit 6545a6b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9160278. Configure here.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.