v1.7.2-jf.3 — jerryfane fork installer + reliability patches

[Unreleased]

Changed

• install.sh now pulls from jerryfane/pilotprotocol releases and source
  instead of TeoSlayer/pilotprotocol. Header URLs updated to
  https://raw.githubusercontent.com/jerryfane/pilotprotocol/main/install.sh
  so SKILL-documented installs land the patched binaries by default.

Added

• beaconKeepaliveLoop running on an independent 25 s ticker
  (DefaultBeaconKeepaliveInterval), separate from the 60 s registry
  heartbeat, so the UDP mapping to the beacon stays alive under consumer
  NAT UDP timeouts (~30-60 s) and relay forwarding remains reachable
  between registry ticks.
• Registry heartbeat can now carry and verify the daemon's current
  registration address. New registry.Client.HeartbeatWithAddr plus
  extended signed challenge (heartbeat:{nodeID}:{addr}); server-side
  handleHeartbeat re-sanitises against the TCP source IP and updates
  node.RealAddr if it changed. Not yet enabled by default — the
  daemon still calls the plain Heartbeat because the upstream public
  registry verifies only the unextended challenge; switch the call site
  once the registry is known to have the matching patch.

Changed

• RelayProbeInterval reduced from 5 min to 60 s so peers marked for
  relay recover quickly after a transient probe failure.
• handlePacket now invokes PortManager.ResetKeepaliveForNode on every
  successfully routed packet, not just ACK/FIN stream frames. Covers
  datagram, control, and non-ACK stream paths where the peer is
  demonstrably alive but would otherwise have tripped dead-peer detection
  during rekey windows.

Fixed

• -public visibility no longer silently reverts on daemon restart.
  pilotctl set-public / set-private and the -public launch flag now
  persist to ~/.pilot/config.json via a new writeConfigKey helper in
  cmd/pilotctl/main.go; daemon start reads the persisted value as a
  fallback when the flag isn't explicitly passed.