Merge refactor-sans-io: reconcile discovery sans-IO core with the FMP v2 delta

Forward-merge the master-side sans-IO refactor (discovery migration + no_std
reductions, collapsed to one commit) into the next-side branch. The discovery
decision core meets next's FMP profile/LookupRequest delta here: next's four
transit-forward predicates (Leaf no-forward, Full-profile, min_mtu, tree/fallback)
are folded into the pure core planners via an extended RoutingView seam
(node_is_leaf / peer_is_full / peer_meets_mtu, new ForwardOutcome::LeafNoForward),
and next's v2 LookupRequest API delta (origin_coords removed, tlv_entries added)
is reconciled across the discovery test tree, with next's four TLV wire tests
ported into the relocated wire test module.

The master-side branch now also carries the no_std+alloc reductions (BTreeMap,
alloc::sync::Arc, backoff-reset log moved to the shell, extern crate alloc),
which come through cleanly on the pilot-only core files.

Validated: cargo fmt / clippy (-D warnings) / test --lib all green, including
next's own transit MTU-pruning integration tests driving the refactored core
through the full shell path.

src/protocol/mod.rs

@@ -20,16 +20,14 @@
 //! Session-layer datagrams are carried as opaque payloads through the link
 //! layer, encrypted end-to-end independently of per-hop link encryption.
 
-mod discovery;
 mod error;
 mod filter;
 mod link;
 mod negotiation;
-mod session;
+pub(crate) mod session;
 mod tree;
 
 // Re-export all public types at protocol:: level
-pub use discovery::{LookupRequest, LookupResponse};
 pub use error::ProtocolError;
 pub use filter::{FilterAnnounce, FilterNack};
 pub use link::{