Switch FMP handshake from Noise IK to XX with version negotiation

Replace the 2-message IK handshake with a 3-message XX handshake for
FMP link establishment. XX requires no prior knowledge of the peer's
static key — both identities are revealed during the handshake
(responder in msg2, initiator in msg3). This is the foundation for
the forklift upgrade that enables rolling protocol upgrades.

Changes:
- Noise XX state machine alongside IK/XK (8 unit tests)
- Protocol negotiation payload codec: format byte, packed version
  min/max, 64-bit feature bitfield, TLV extensions (11 unit tests)
- FMP wire format version 0→1, msg3 header/builder, TCP stream framing
- FMP handshake switched to XX: PeerConnection 3-message flow,
  handle_msg1 simplified (no identity), handle_msg2 sends msg3 and
  promotes initiator, new handle_msg3 promotes responder with
  restart/rekey/cross-connection detection
- Rekey handshake switched to XX with negotiation payload hash chain
  fix (decrypt-and-discard in complete_rekey_msg2/msg3)
- Negotiation payload in msg2/msg3 (FMP version [1,1], features=0)
- Debug logging for handshake promotion paths
- Integration test convergence timeouts adjusted for extra round-trip

Squashed commits:
- Add Noise XX state machine alongside IK/XK
- Add protocol negotiation payload codec
- FMP wire format prep: version 1, msg3 header support
- Switch FMP handshake from Noise IK to XX
- Increase convergence timeouts for XX 3-message handshake
- Fix negotiation hash chain desync in rekey handshake

src/node/tests/spanning_tree.rs

@@ -69,9 +69,7 @@ pub(super) async fn initiate_handshake(nodes: &mut [TestNode], i: usize, j: usiz
 
     let our_index = initiator.node.index_allocator.allocate().unwrap();
     let our_keypair = initiator.node.identity().keypair();
-    let noise_msg1 = conn
-        .start_handshake(our_keypair, initiator.node.startup_epoch, 1000)
-        .unwrap();
+    let noise_msg1 = conn.start_handshake(our_keypair, initiator.node.startup_epoch, 1000).unwrap();
     conn.set_our_index(our_index);
     conn.set_transport_id(transport_id);
     conn.set_source_addr(responder_addr.clone());
@@ -186,12 +184,7 @@ pub(super) fn print_tree_snapshot(label: &str, nodes: &[TestNode]) {
                 .count();
             eprintln!(
                 "  node[{}] root=node[{}] depth={} parent=node[{}] peers={} pending={}",
-                i,
-                root_idx,
-                ts.my_coords().depth(),
-                parent_idx,
-                tn.node.peer_count(),
-                pending,
+                i, root_idx, ts.my_coords().depth(), parent_idx, tn.node.peer_count(), pending,
             );
         }
     } else if correct_root_count < nodes.len() {
@@ -216,9 +209,7 @@ pub(super) fn print_tree_snapshot(label: &str, nodes: &[TestNode]) {
 ///
 /// Returns the number of packets processed.
 pub(super) async fn process_available_packets(nodes: &mut [TestNode]) -> usize {
-    use crate::node::wire::{
-        COMMON_PREFIX_SIZE, CommonPrefix, FMP_VERSION, PHASE_ESTABLISHED, PHASE_MSG1, PHASE_MSG2,
-    };
+    use crate::node::wire::{CommonPrefix, FMP_VERSION, PHASE_ESTABLISHED, PHASE_MSG1, PHASE_MSG2, PHASE_MSG3, COMMON_PREFIX_SIZE};
 
     let mut count = 0;
     for node in nodes.iter_mut() {
@@ -233,7 +224,10 @@ pub(super) async fn process_available_packets(nodes: &mut [TestNode]) -> usize {
                 match prefix.phase {
                     PHASE_MSG1 => node.node.handle_msg1(packet).await,
                     PHASE_MSG2 => node.node.handle_msg2(packet).await,
-                    PHASE_ESTABLISHED => node.node.handle_encrypted_frame(packet).await,
+                    PHASE_MSG3 => node.node.handle_msg3(packet).await,
+                    PHASE_ESTABLISHED => {
+                        node.node.handle_encrypted_frame(packet).await
+                    }
                     _ => {}
                 }
                 count += 1;
@@ -326,11 +320,7 @@ pub(super) async fn drain_all_packets(nodes: &mut [TestNode], verbose: bool) ->
 ///
 /// First builds a random spanning tree to ensure connectivity,
 /// then adds extra edges up to the target count.
-pub(super) fn generate_random_edges(
-    n: usize,
-    target_edges: usize,
-    seed: u64,
-) -> Vec<(usize, usize)> {
+pub(super) fn generate_random_edges(n: usize, target_edges: usize, seed: u64) -> Vec<(usize, usize)> {
     use rand::rngs::StdRng;
     use rand::{RngExt, SeedableRng};
 
@@ -384,7 +374,11 @@ pub(super) fn verify_tree_convergence(nodes: &[TestNode]) {
     assert!(n > 0);
 
     // Find the expected root (smallest NodeAddr across all nodes)
-    let expected_root = nodes.iter().map(|tn| *tn.node.node_addr()).min().unwrap();
+    let expected_root = nodes
+        .iter()
+        .map(|tn| *tn.node.node_addr())
+        .min()
+        .unwrap();
 
     // All nodes should agree on the root
     for (i, tn) in nodes.iter().enumerate() {
@@ -634,16 +628,12 @@ pub(super) async fn run_tree_test_with_mtus(
         assert!(
             nodes[i].node.get_peer(&j_addr).is_some(),
             "Node {} should have peer {} (node {})",
-            i,
-            j_addr,
-            j
+            i, j_addr, j
         );
         assert!(
             nodes[j].node.get_peer(&i_addr).is_some(),
             "Node {} should have peer {} (node {})",
-            j,
-            i_addr,
-            i
+            j, i_addr, i
         );
     }