peer: add the per-peer FMP control state machine (XX, unwired)

Re-derive the per-peer FMP lifecycle state machine against the next-line
XX establishment cores, as an unwired module. It ports the master-line
machine's structure but adapts it to the XX handshake:

- inbound establishment splits into a msg1 event (allocate the index,
  send msg2, defer) and a msg3 classify event (identity crystallizes,
  establish_inbound runs), matching XX's identity-at-msg3 timing;
- the inbound decision handles all six InboundDecision variants including
  the XX-only CrossConnect;
- the outbound establish_outbound path and the two-phase authorize are
  dropped (no analog on the XX line);
- session-carrying establish effects (cross-connect swap, rekey-respond
  pending session) are represented as plain-data trigger actions; the
  session surgery is done shell-side when the machine is wired.

Nothing drives the machine yet; it is dead code pending the executor and
handler wiring. Unit tests cover the XX dispatch: inbound establish to
Established, dual-init tie-break, cross-connect at msg3, rekey cutover
key-consistency, and liveness reporting.

src/peer/mod.rs

@@ -11,6 +11,7 @@ mod active;
 #[cfg(any(target_os = "linux", target_os = "macos"))]
 pub(crate) mod connected_udp;
 mod connection;
+pub(crate) mod machine;
 
 pub use active::{ActivePeer, ConnectivityState};
 pub use connection::{HandshakeState, PeerConnection};