v0.27.0+ciris.1 — catch up to upstream master (+465)

Catch-up to upstream master (+465), including upstream's 0.9.0 release
(2026-09-18) and 44 entries in its current Unreleased section.

Absorbed upstream (dropped from the carry)

• unregister_destination on ReticulumNode (leviculum#54).
• NTFS-safe lnflash sysfs fixtures (no : in committed paths).
• The Linux-only gating of the BLE dependencies (leviculum#64).
• The Unix-only parent-directory fsync in the file identity store (leviculum#65).
• The self-spawned pipe-bridge child in the pipe interface tests.

Carried features ported onto upstream's changes

• Scoped transit (leviculum#51): the per-interface transit flag now applies
  inside upstream's register_interface_config helper, and upstream's new BLE
  interface declares transit: true like every other interface.
• Control-plane drop ladder and watermark (leviculum#60): upstream moved the
  drop counter into an Arc<Counter64> shared with the EventReceiver
  (Codeberg #419), which mints the overflow marker and resets the count. The
  doubling warn ladder now resets when a new drop episode starts at a count of
  one. plane_stats() keeps its own cumulative counters, because upstream's
  counter is reset on every marker.
• Per-peer outbound circuit breaker (leviculum#66): the shed counter uses
  upstream's Counter64, and the breaker ignores upstream's new peer field
  on Action::SendPacket. A multi-peer interface shares one transmit queue,
  so it keeps one breaker.
• Upstream's new shared-instance disconnect path now passes the segment
  assembler (leviculum#62), the plane counters (leviculum#60) and the breakers
  (leviculum#66) to dispatch_output, like every other call site.

Fixed on the fork's CI lanes (upstream's CI is Linux-only)

• Security: h2 0.4.19 (RUSTSEC-2026-0258) and rustls 0.23.45
  (RUSTSEC-2026-0285). Taking upstream's lockfile had put the vulnerable h2
  back. Both are reached only through lblogd and async-web-client.
• Windows build: upstream's announce-stall-probe (Codeberg #418) uses raw
  FIFO descriptors. It is now Unix-only, with a stub main elsewhere, and its
  test is Unix-only.
• macOS: APFS refuses non-UTF-8 file names (EILSEQ), which broke the two
  foreign-filename store tests. They now accept that refusal and are Unix-only.
• Windows: the UDP device-form test binds a broadcast address, as
  UDPInterface.py does, and Windows refuses that bind. It is ignored on
  Windows with that reason.

Consumer notes (CIRISEdge)

• CooperativeStamper::generate now takes a fourth argument,
  &StampCancel. Pass &StampCancel::new() where no cancellation is needed.
• ControlPlaneOverflow is minted by the EventReceiver. It arrives ahead of
  the backlog, at most once per second.
• A peer's rejection surfaces as ResourceError::RejectedByRemote, not
  Cancelled. A failed middle segment emits ResourceFailed, and
  request-carrying resources no longer emit ResourceCompleted.