Add nostr-publish-consume integration suite

Cover the previously untested overlay advert publish/relay/consume
round-trip. The bilateral publish/subscribe path was a v0.3.0 release
gap: malformed adverts could panic consumers, broken signatures could
go undetected, and reverse-direction subscription was unverified.

Adds testing/nat/scripts/nostr-relay-test.sh (290 lines):

Phase 1+2 (combined): wait_for_peers on both nodes; pass on
bidirectional advert publish/subscribe round-trip + dial completed;
ping6 both directions confirms TUN-level reachability.

Phase 3 (malformed advert resilience): stdlib-only Python WebSocket
client publishes a syntactically valid Schnorr-signed Kind-37195
event whose `content` is gibberish (cannot deserialize as
OverlayAdvert). The relay enforces BIP-340 signature validity, so the
event reaches the consumers (rather than being dropped at the relay)
— a trivially-junk content payload is the right adversarial input.
Required ~80 lines of stdlib-only secp256k1 + BIP-340 in the script
(no new container deps). Asserts pidof fips on both nodes after the
publish, scans logs for panic markers, re-pings to prove the existing
peer link survives.

testing/nat/docker-compose.yml: new profile nostr-publish-consume
with two daemon services (nostr-pub-a 172.31.10.20, nostr-pub-b
172.31.10.21) on shared-lan, reusing the existing strfry relay
(172.31.10.30:7777) and STUN service (172.31.10.40:3478).

testing/nat/scripts/generate-configs.sh: 2-line allowlist update so
the new scenario flows through the existing config generator (rather
than forking a parallel one). Generated node-{a,b}.yaml + npubs.env
smoke-tested cleanly.

testing/ci-local.sh: NOSTR_RELAY_SUITES=(nostr-publish-consume)
array, run_nostr_publish_consume runner, dispatch in run_integration
and run_suite. Mirrors existing run_nat shape.

.github/workflows/ci.yml: one matrix row + 3 steps in the integration
job, gated on matrix.type == 'nostr-publish-consume'. Consumes the
same fips-linux artifact and fips-test:latest image as the existing
NAT suites.

Tor/TCP transport variants kept out of v0.3.0 scope; the structure
leaves room for nostr-publish-consume-tcp/-tor siblings later without
disturbing this baseline.

testing/ci-local.sh

@@ -18,6 +18,7 @@
 #   static-mesh, static-chain, rekey, rekey-accept-off,
 #   rekey-outbound-only, gateway,
 #   acl-allowlist, nat-cone, nat-symmetric, nat-lan,
+#   nostr-publish-consume,
 #   chaos-smoke-10, chaos-churn-mixed-10, chaos-ethernet-mesh,
 #   chaos-ethernet-only, chaos-tcp-mesh, chaos-bottleneck-parent,
 #   chaos-cost-avoidance, chaos-cost-reeval, chaos-cost-stability,
@@ -74,6 +75,7 @@ GATEWAY_SUITES=(gateway)
 SIDECAR_SUITES=(sidecar)
 ACL_SUITES=(acl-allowlist)
 NAT_SUITES=(cone symmetric lan)
+NOSTR_RELAY_SUITES=(nostr-publish-consume)
 DNS_RESOLVER_SUITES=(dns-resolver)
 DEB_INSTALL_SUITES=(deb-install)
 TOR_SUITES=(tor-socks5 tor-directory)
@@ -114,6 +116,9 @@ list_suites() {
     echo "  NAT scenarios:"
     for s in "${NAT_SUITES[@]}"; do echo "    nat-$s"; done
     echo ""
+    echo "  Nostr publish/consume:"
+    for s in "${NOSTR_RELAY_SUITES[@]}"; do echo "    $s"; done
+    echo ""
     echo "  Chaos scenarios:"
     for entry in "${CHAOS_SUITES[@]}"; do
         read -ra parts <<< "$entry"
@@ -446,6 +451,19 @@ run_nat() {
     fi
 }
 
+# Run the Nostr overlay advert publish/consume integration test.
+# Two FIPS daemons + the existing strfry relay; exercises Phase 1
+# (A→B publish/consume), Phase 2 (B→A reverse), and Phase 3 (malformed
+# advert injected directly to the relay; consumer-liveness assertion).
+run_nostr_publish_consume() {
+    info "[nostr-publish-consume] Running Nostr publish/consume test"
+    if bash testing/nat/scripts/nostr-relay-test.sh 2>&1; then
+        record "nostr-publish-consume" 0
+    else
+        record "nostr-publish-consume" 1
+    fi
+}
+
 # Run dns-resolver harness (multi-distro + e2e scenarios)
 run_dns_resolver() {
     info "[dns-resolver] Running multi-distro test (slow — builds per-distro images)"
@@ -527,6 +545,11 @@ run_integration() {
         run_nat "$scenario"
     done
 
+    # Nostr publish/consume (sequential — shares the NAT compose project)
+    for _suite in "${NOSTR_RELAY_SUITES[@]}"; do
+        run_nostr_publish_consume
+    done
+
     # Chaos scenarios (parallel, throttled)
     if [[ "$SKIP_CHAOS" != true ]]; then
         info "Running ${#CHAOS_SUITES[@]} chaos scenarios (max $PARALLEL_JOBS parallel)"
@@ -611,6 +634,8 @@ run_suite() {
             run_acl_allowlist ;;
         nat-cone|nat-symmetric|nat-lan)
             run_nat "${suite#nat-}" ;;
+        nostr-publish-consume)
+            run_nostr_publish_consume ;;
         chaos-*)
             local chaos_name="${suite#chaos-}"
             local found=false