Harden live shred receiver and bounded repair

[augustin-cheron]

Summary

• preserve and forward every valid Turbine duplicate through bounded queues
• add Linux UDP/softnet/NIC loss telemetry and explicit AF_XDP decision logs
• add bounded Agave repair with leader/version/Merkle trust, backward chained-root recovery, and a separate 256 MiB provenance WAL
• add a read-only fresh 10,000-slot NAS reconstruction audit runbook
• publish a Bookworm-compatible, revision-labelled GHCR image and require immutable digest deployment

Safety

• repaired shreds never enter the raw WAL or forwarding path
• repair queue, RPC, peer, trust, or WAL failure leaves raw capture running
• chain conflicts block only the affected slot before WAL persistence
• production rollout is canary-gated on zero forward/repair queue loss, zero kernel-loss deltas, and stable Hivezilla durability

Validation

• cargo fmt --check
• cargo metadata --locked
• Docker Compose config validation
• full test/clippy and runtime linkage verification run in the publish workflow

The independent second receiver / AF_XDP experiment is intentionally deferred until this canary has enough loss data.