Merge branch 'master' into next

Forward-merge of 12 master commits past the previous merge
(823b830, master @ 18019bb): dep-audit bumps (rand,
clap, tun, rtnetlink, windows-service, plus the bump-safe
lockfile batch), bloom-storm chaos scenario, control-socket
resolver consolidation, gateway dns.listen default change,
OpenWrt ipk README refresh, gateway tutorial review, Ethernet
MTU rustdoc fix, dead session-variant drop, CHANGELOG prep.

Conflict resolution:

- CHANGELOG.md: both bullets kept under [Unreleased] / Fixed.
  Master's spanning-tree internal-path-propagation fix precedes
  next's tree-ancestry-test determinism entry and the
  responder-Disconnect XX-handshake entry.
- src/protocol/session.rs: kept next's SessionSetup/SessionAck
  variants and rustdoc. Master's drop of those variants suits
  v0.3.0's FSP phase-byte dispatch but is undone by next's
  v0.4.0 wire format, which retains the variants and uses the
  inner msg_type byte for handshake identification.
- src/transport/ethernet/mod.rs: kept next's "interface MTU - 4"
  comment. Master corrected the v0.3.0 3-byte rustdoc; next
  redesigned the framing to a 4-byte header (type/flags/length)
  for shared-media beacons, so master's correction does not
  apply to next's format.

Auto-merged cleanly: Cargo.toml (next's 0.4.0-dev + the new dep
pins from master), Cargo.lock, all gateway docs,
docs/reference/configuration.md, packaging files,
.github/workflows/ci.yml, testing/chaos/sim/* and
testing/ci-local.sh (bloom-storm additions), src/config/*.

Local verification: cargo build --release, cargo test (1252
passed, 4 ignored), cargo clippy -D warnings, cargo fmt --check
all green.

src/config/node.rs

@@ -784,20 +784,15 @@ impl ControlConfig {
 
     /// Default control socket path.
     ///
-    /// On Unix, returns a Unix domain socket path (XDG_RUNTIME_DIR, /run/fips,
-    /// or /tmp fallback). On Windows, returns a TCP port number as a string
-    /// since Windows does not support Unix domain sockets; the control socket
-    /// listens on localhost at this port.
+    /// On Unix, delegates to [`super::resolve_default_socket`] for the
+    /// canonical `/run/fips` → `XDG_RUNTIME_DIR` → `/tmp` order shared with
+    /// the client-side `default_control_path`. On Windows, returns a TCP
+    /// port number as a string since Windows does not support Unix domain
+    /// sockets; the control socket listens on localhost at this port.
     fn default_socket_path() -> String {
         #[cfg(unix)]
         {
-            if let Ok(runtime_dir) = std::env::var("XDG_RUNTIME_DIR") {
-                format!("{runtime_dir}/fips/control.sock")
-            } else if std::fs::create_dir_all("/run/fips").is_ok() {
-                "/run/fips/control.sock".to_string()
-            } else {
-                "/tmp/fips-control.sock".to_string()
-            }
+            super::resolve_default_socket("control.sock")
         }
         #[cfg(windows)]
         {