fix(kerykeion): recover receive stream from malformed protobuf payloads

[forkwright]

Closes #191

What

MeshCodec::decode() treated a malformed FromRadio protobuf payload inside an otherwise well-framed packet as fatal (FromRadio::decode(payload.as_ref()).context(ProtobufDecodeSnafu)?), while every other corruption class the decoder can encounter (bad magic, oversized/zero length, partial payload) was recovered with Ok + re-loop. tokio_util::codec::Framed tears down the whole connection on any Decoder::Error, so one adversary-controlled mesh frame permanently killed the receive stream — the prime OTA DoS site named in the issue.

Decoder::decode() now has no Err-returning path at all: a malformed payload is logged via tracing::warn! (with error + payload_len) and falls through to re-loop, exactly matching the decoder's other corruption-recovery branches.

Dropped the now-unused snafu::ResultExt and ProtobufDecodeSnafu imports from codec.rs (ProtobufDecodeSnafu is still used by mqtt.rs, so only the import in codec.rs was dead).

Tests

• decoder_malformed_payload_then_valid_frame_still_decodes — a malformed frame immediately followed by a valid frame in the same buffer; the valid frame still decodes.
• decoder_malformed_payload_alone_returns_none — a malformed frame alone in the buffer returns Ok(None), never Err.
• Both share a frame_malformed_payload() helper: a well-framed header wrapping a single 0x00 payload byte, which prost rejects unconditionally as protobuf tag 0 (field number 0 is reserved) — a malformed-payload case that's guaranteed to fail FromRadio::decode independent of the message's oneof variants.
• Tightened the existing codec_handles_arbitrary_bytes_without_panic proptest to assert result.is_ok() instead of accepting Err as a benign outcome — that leniency is exactly what let this DoS class through the property test in the first place.

Evidence

$ cargo test -p kerykeion codec::
running 16 tests
test codec::tests::decoder_malformed_payload_alone_returns_none ... ok
test codec::tests::decoder_malformed_payload_then_valid_frame_still_decodes ... ok
... (16 passed; 0 failed)

Full gate (vgate kanon gate --stamp):

Summary [6.096s] 773 tests run: 773 passed, 0 skipped
kanon lint: 0 error(s), 0 warning(s), 0 info (209 suppressed)
PASS  cargo fmt
PASS  cargo check (workspace)
PASS  advisory ignore parity
PASS  derive check (deterministic)
PASS  kanon fitness
PASS  dependency audit (cargo deny)
PASS  cargo clippy (workspace)
PASS  cargo nextest (workspace)
PASS  kanon lint
PASS  fleet-names freshness
Gate-Passed: kanon 0.1.10 +stages:fmt,check,clippy,nextest,lint sha:bbfb474b2e665b6f7438fd93bb3550bac233e365