feat(fabric): add tenant-wildcard comms subscribe (RIG-3107) - #903

… (RIG-3107)

The subscribe path decoded an EventRef and handed it to the subscriber without
comparing the ref's tenant to the subject the message arrived on, so the
tenant-isolation invariant was enforced on the write side only. Publish derives
the required subject from the ref and refuses a mismatch, but Publish is not the
only writer the stream can have: COMPASS_COMMS is shared and the server carries
no per-tenant authorization yet, so any client that reaches the client port can
put arbitrary bytes on any comms subject.

That mattered because EventRef's contract directs a subscriber to re-read its
row under ref.Tenant WITHOUT consulting the subject. A ref naming tenant-a
delivered on tenant-b's subject therefore drove a tenant-b-scoped subscriber to
read a tenant-a row. SubscribeKind makes it the primary path rather than a
latent gap: its consumer spans every tenant, which leaves the payload's tenant
field as the only scope a delivery carries.

handleEvent now rebuilds the wanted subject from the ref and parks on a
mismatch. A mismatch is as unprocessable as an undecodable payload, so it parks
rather than retrying, and the DLQ entry keeps the concrete delivered subject so
an operator can see which tenant was targeted.

Also wires nats.ErrorHandler, without which the Runner plane's documented
dropped-and-reported semantic was only dropped: nats.go reports a full channel
subscription through the async error callback and the defaults install none, so
the fabric's one lossy path dropped events with no log line, no metric and no
error.

…mer report (RIG-3107)

Two guarantees from the review loop shipped without tests, and both fail
invisibly.

The subject cross-check parks a ref whose tenant disagrees with its delivered
subject, deciding that by rebuilding the subject with the same CommsSubject call
Publish uses. That the two agree was emergent rather than tested: a one-sided
change — normalizing, lowercasing or trimming the tenant token on one side only
— would park every legitimate delivery on every tenant, a silent fleet-wide
denial of delivery whose only signal is a filling DLQ. The forged-ref test
covers the negative case and the wildcard tests only exercise SubscribeKind, so
the highest-traffic path had no defense. TestLegitimateRefsSurviveTheSubjectCrossCheck
publishes across the token space ValidSubjectToken admits — dashes,
underscores, mixed case, a uuid — asserts each is delivered through a concrete
Subscribe, and asserts nothing legitimate reaches the DLQ.

The async error handler is the Runner plane's only report of its only lossy
path, and nats.go installs none by default while its own fallback writes to raw
stderr rather than the fabric's logger. Dropping or shadowing the option would
silently return the plane to losing events invisibly with no test failing.
TestAsyncErrorHandlerReportsSlowConsumers invokes the installed handler directly
— nats.go dispatches it on its own goroutine holding no lock, so calling it is
faithful and carries no timing dependence — covering both the nil-subscription
branch that the whole drain path takes and the branch that must name the subject.
TestCallerErrorHandlerWins pins the Config.Options precedence, which is correct
to allow here because the handler is log-only, unlike the ClosedHandler that
Close deliberately avoids depending on.