Recover timed-out Iroh lanes and stale iOS sessions

[azooz2003-bit]

What changed

• Redial the exact authenticated Iroh connection after an application-lane timeout only when its cached session is closed.
• Keep stream-local application-lane rejection from terminating the endpoint.
• Prevent a stale session owner from evicting its replacement.
• Recover an iOS shell whose initial subscription stream ends before acknowledgement by reconnecting the stored, EndpointID-pinned Iroh route.
• Bound recovery to one retry and preserve the no-raw-fallback policy.

Verification

• swift test --package-path Packages/Shared/CmuxIrohTransport: 354 tests, 42 suites passed.
• swift test --package-path Packages/iOS/CmuxMobileShell: 537 tests, 49 suites passed.
• Tagged macOS tsmig build succeeded locally at this head.
• Tagged isolated Simulator build succeeded.
• Staging automatic mode: Iroh route selected, subscription healthy, terminal lane and composer RPC succeeded.
• Staging relay-only mode: Iroh route selected, subscription healthy, terminal lane and composer RPC succeeded.

Follow-up evidence

Strict prior-paired direct-only E2E exposed an existing lost initial watchAddr event. The client stayed pinned to Iroh and timed out without raw fallback. A regression-tested replay fix will be added to this PR before merge.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

Summary by cubic

Recovers timed‑out Iroh lanes and stale iOS sessions, adds zero‑touch same‑account Iroh connect, and hardens startup/reconnect with server Retry‑After backoff, per‑account gates, and a shared dev broker/relay so tagged Mac+iOS builds find each other. Enforces trusted pairing (rejects untrusted tickets/routes and loopback on devices), keeps tagged pairings on one Mac, and adds stalled mobile RPC write recovery.

• New Features

  • Zero‑touch same‑account Iroh discovery/connect (dev‑tag isolated), capped at 4; persist only after authenticated host status.
  • Startup ownership: MobileStartupConnectionCoordinator serializes injected attach vs stored reconnect; MobileRPCClientLifecycleGate linearizes retirement vs new transports.
  • Backoff: unify server Retry‑After via CmxRetryAfterProviding; iOS coalesces broker‑directed retries per account (MobileAutomaticReconnectBackoffOwner).
  • Shared dev trust: AuthEnvironment.irohBrokerBaseURL and CI vars route Debug to one staging broker/relay; rotated signer with fallback; live discovery refresh returns true only after a new verified snapshot.

• Bug Fixes

  • Iroh reliability: keep sessions on per‑stream lane rejection; redial only after the admitted QUIC session closes; replay early direct‑address events; republish address after relay install/replacement; bound address‑less retries; cancel recovery on sign‑out.
  • RPC robustness: recover stalled writes (transportWriteTimedOut) by recycling transports; publish connection state atomically; prevent half‑installed connections.
  • Pairing trust/identity: fail closed on untrusted tickets/routes; reject loopback reconnect on physical devices; enforce per‑app‑instance quotas/identity; coalesce by Iroh endpoint to keep tagged pairings on one Mac; accept higher dev discovery counts within scaled limits.
  • Host/LAN: wait for tagged endpoint publication before QR upgrade; respect listener settings; schedule/cancel LAN publication and relay tasks correctly.

^{Written for commit 48706fc. Summary will update on new commits.}

Summary by CodeRabbit

• New Features

  • Added live discovery snapshot tracking plus an async live-discovery refresh API.
  • Introduced a startup coordinator to serialize injected attach vs stored reconnect.
  • Added zero-touch Iroh candidate discovery with a capped automatic selection count.

• Bug Fixes

  • Improved connection and lane recovery with session replacement, retries, and endpoint identity mismatch handling.
  • Refined server handling of rejected application lanes so the session stays usable for subsequent lanes.
  • Added user-visible handling for transport write timeouts and broadened recovery/disconnect classification.

• Tests

  • Expanded coverage across recovery, discovery refresh/lifecycle races, and reconnection route selection.