fix(pairing): connect after trusted code confirmation

[bestlux]

Summary

• bound outbound transport TCP dials so a stale or blocked discovered endpoint cannot stall the post-pairing reconnect worker
• surface post-trust transport reachability failures in peer health with the existing redacted next-action detail
• add focused regressions for pairing trust -> reachability health and bounded TCP timeout classification

Validation

• cargo test -p boundless-daemon pairing_commit_surfaces_trust_metadata_and_survives_restart --quiet
• cargo test -p boundless-daemon transport_error_summary_classifies_bounded_tcp_connect_timeout --quiet
• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• git diff --check

Notes

• Preserves pairing code validation and trust authorization boundaries; reconnect is still only after trust commit.
• No installer, firewall, trust reset, input broker, launcher, release, or package changes.
• Live two-PC dogfood is still required after merge/package to confirm the transport path is reachable on the user's network.