Parity reaudit

Peer-gap re-audit after the production-parity leftovers branch. Canonical copy: parity re-audit.

Leftovers BASELINE_SHA is 46163c95ce7df6e6d3271fc1d2cf26c655fca0aa. WebSocket over HTTP/3, Gateway L4/gRPC kinds, GeoIP, compression/zstd, gRPC health, DNS SRV, TCP TLS terminate, zone-aware LB, xDS ADS (lazy), listener reconcile, and overload protection are on the matrix. Dashboard editing (JSON editor forms) is supported. Hot restart stays partial: TCP hands over without a gap and titanium restart drives it, but HTTP/3 and UDP bind only after the old process exits. Runtime-blocked items (WebTransport/datagrams, 0-RTT, Windows cipher policy, ticket-key sharing, win-arm64 natives) were re-checked against .NET 10 and not promoted. Checkpoint A/B links against the baseline are still required on the Draft PR before merge.