v0.28.0+ciris.1 — catch up to upstream master (+164) and the #49 fix

Catch-up to upstream master (+164 since the v0.27.0 base), plus the
known-destinations backpressure fix. The rebase applied cleanly: no carry
commit conflicted and none was absorbed.

Fixed (CIRIS fork)

• Known destinations under capacity pressure keep their pins and stay pruned
  (leviculum#49). The identity cap evicts unretained destinations first. Each
  flush holds the on-disk file to the cap instead of resurrecting what memory
  evicted. Runtime retain and last-use state reach the file, disk pins are
  seeded at load, and pruning is reported by the catalogued
  KNOWN_DESTINATIONS_PRUNED event and MemoryStorage::identity_evictions().

Fixed on the fork's CI lanes

• Upstream's diagnostic-dump test asserted the "Census gap" line, which
  follows an RSS read from /proc/self/statm. Only Linux has that file, so
  the assertion is now Linux-only (the macOS and Windows lanes).

From upstream, relevant to library consumers

• Links over asymmetric paths to Python RNS 1.5 peers now form. A
  link-request proof whose hop count disagrees with the frozen tables is
  re-balanced as RNS 1.5 does (upstream Codeberg #330), without deleting the
  route it corrects.
• A local link routes its resource proof to the destination, not back to the
  initiator.
• A resource receiver paces its part timeout by the parts it actually sees.
• A sender waiting on a peer that stopped answering no longer outlives its
  caller's deadline.
• A path to a peer used five minutes ago no longer expires early, and a node
  no longer holds back the answer to its own path request.
• A stale echo installs no path but still reaches local clients, and a daemon
  routes to its own returned client rather than through the mesh.