node: extract lifecycle supervisor FSM, migrate substrate fields (behavior-neutral)

Introduce a sans-IO lifecycle supervisor: a synchronous step(event) ->
[action] state machine (SupervisorFsm) that authors the substrate-child
spawn and teardown order, plus an owner struct (Supervisor) holding the
substrate runtime fields and embedding the FSM. The substrate-lifecycle
fields leave Node's flat list into the owner - state, packet_tx, the TUN
reader/writer handles + shutdown fd + channels, the DNS task + identity
channel, the Nostr/LAN rendezvous drivers, and the encrypt/decrypt worker
pools; the dataplane keeps packet_rx.

start()/stop() become the driver executing the FSM's SpawnChild/StopChild
actions: same children, same order, same warn/debug-and-continue on
optional failures, same logs, same NodeState transitions. Behavior- and
wire-neutral. The only determinism change is that transports now tear
down in ascending-id order, previously nondeterministic HashMap iteration.

The bounded Draining phase and the Running{Full|Degraded} health split
land as separate follow-on commits.

src/node/handlers/session.rs

@@ -374,7 +374,7 @@ impl Node {
                                     mark_ipv6_ecn_ce(&mut packet);
                                     self.metrics().congestion.ce_received.inc();
                                 }
-                                if let Some(tun_tx) = &self.tun_tx {
+                                if let Some(tun_tx) = &self.supervisor.tun_tx {
                                     if let Err(e) = tun_tx.send(packet) {
                                         debug!(error = %e, "Failed to deliver decompressed IPv6 packet to TUN");
                                     }
@@ -1832,7 +1832,7 @@ impl Node {
         send: PipelinedSend<'_>,
     ) -> Result<bool, NodeError> {
         let dest_addr = send.dest_addr;
-        let Some(workers) = self.encrypt_workers.as_ref().cloned() else {
+        let Some(workers) = self.supervisor.encrypt_workers.as_ref().cloned() else {
             return Ok(false);
         };
 
@@ -2448,7 +2448,7 @@ impl Node {
         let our_ipv6 = FipsAddress::from_node_addr(self.node_addr()).to_ipv6();
         if let Some(response) =
             build_dest_unreachable(original_packet, DestUnreachableCode::NoRoute, our_ipv6)
-            && let Some(tun_tx) = &self.tun_tx
+            && let Some(tun_tx) = &self.supervisor.tun_tx
         {
             let _ = tun_tx.send(response);
         }
@@ -2483,7 +2483,7 @@ impl Node {
         // causes a PMTUD blackhole when both src and ICMP-src are local.
         let dest_addr = Ipv6Addr::from(<[u8; 16]>::try_from(&original_packet[24..40]).unwrap());
         if let Some(response) = build_packet_too_big(original_packet, mtu, dest_addr)
-            && let Some(tun_tx) = &self.tun_tx
+            && let Some(tun_tx) = &self.supervisor.tun_tx
         {
             debug!(
                 original_src = %src_addr,