v0.25.0+ciris.1 — upstream +92, and three fixes found gating it

Catches the CIRIS fork up to upstream master 28de8362 (+92) and fixes three
things found while gating that catch-up.

Fixed — the retry queue is diagnosable and quiet (#63)

Reported from the live canonical, where the retry queue climbed past its
warning threshold and began discarding traffic while the log read as quiet.
Warnings now name their peer (a drop line said iface=7, and the accept line
that would have identified it had been suppressed by log dedup). The depth
watermark logs on a doubling ladder instead of per increment — ~10 lines an
episode instead of hundreds, with the last line before drops always emitted.
The drop warning states that any max-depth line below the cap understates the
peak, because a drop only fires at the cap. And plane_stats() gains
retry_queued, retry_queue_cap and retry_dropped_total, so the queue is
watchable as it climbs rather than announced by its first discard.

Whether backpressure should propagate to the producer instead of being
absorbed by the queue is a design change and stays open, now with the
instrumentation to decide it on evidence.

Fixed — BLE is Linux-only, so its dependencies must be too (#64)

Upstream's new BLE interface declared bluer and dbus unconditionally; both
pull libdbus-sys, which does not build on macOS or Windows. That reached a
consumer rather than only a CI lane — CIRISEdge's darwin and win_amd64 wheels
resolve this crate as a git dependency. The deps are now target-gated and the
modules cfg-gated; configuring a BLEInterface off Linux returns a typed
error naming the reason instead of failing to compile.

Fixed — a directory fsync is a Unix move, not a portable one (#65)

With the build fixed, the Windows lane ran tests for the first time this sync
and found a second, independent break. Upstream's cf0e24cc added a
parent-directory fsync after the identity save's rename. Correct on Unix; on
Windows File::open cannot open a directory at all, so the line did not skip
the flush — it failed the save with Access is denied. (os error 5) and took
every test that builds a node with it (20+ in driver::builder::tests, plus
api::tests::node_lifecycle_without_interfaces). leviculum-core was
unaffected. The fsync is now #[cfg(unix)].

Both Windows breaks are upstream's code and invisible to them — their CI is
Linux-only. This is what the fork's Windows lane is kept for.

Fixed — a live link survives a rotation, and sealing states its price (#52)

s6_live_links_survive_rotation was failing ~50% of runs. Measuring it found
a real defect and a wrong assumption in the test.

The driver masked with a key the peer had already retired: the event loop
refreshed its IFAC map at the top of each iteration and then parked in
select!, so a send that woke it was dispatched against the pre-rotation map.
The map is now refreshed immediately before every dispatch.

The rest is not a bug. install and activate are make-before-break, so
neither can lose a packet. seal retires the old key for inbound too, so
anything still masked with it is rejected on arrival — bytes in a socket, in a
retry queue, or in the peer's receive buffer. Sealing with no dwell after
activating strands that in-flight traffic. The obligation to leave a dwell is
documented on the rotation API, and the test now rotates the way an operator
must. Nothing imposes a dwell in the library: each phase is an explicit
operator call so the cutover moment stays the operator's to choose.

Evidence: rotation removed, 6/6 pass; install alone, 5/5; install+activate,
5/5; only sealing failed, with exactly one drops_ifac at the peer on every
failing run and none on any passing one. Stress after both fixes: 0/12
failures, was 4/8.

Upstream

The catch-up rebase was clean and every carried feature was symbol-audited
after. Two places where upstream's new code met the fork's carry, both
mechanical: the BLE interface's InterfaceInfo takes the declared-transit
flag (#51), and upstream's new dispatch_output call site for BLE peer-loss
threads the multi-segment assembler (#62).

The BLE target-gating is worth offering upstream — it makes their crate
buildable off Linux, with BLE fully available wherever BlueZ exists.