peer: make the outbound msg2 swap/keep machine arms decision-only

The machine's on_msg2 cross-connection arms crystallized state and
emitted FreeIndex/RegisterDecryptSession actions that duplicate the
inline shell resolution, but they are unreachable on the live path
(the shell removes the machine before running the swap/keep bodies).
Making them live in that shape would double-free the outbound index
through the executor.

Strip both arms to a single new ResolveCrossConnection { swap }
action: a decision conveyed to the driver, not an effect. The shell
intercepts it and runs the inline resolution, which owns all effects
permanently. The action executor gets a defensive unreachable arm.
The Promote arm and set_their_index are unchanged.

src/node/dataplane/peer_actions.rs

@@ -387,6 +387,16 @@ impl Node {
                         }
                     }
                 }
+                PeerAction::ResolveCrossConnection { .. } => {
+                    // A decision token, not an effect: the outbound msg2
+                    // handler intercepts it and runs the inline swap/keep
+                    // resolution itself, so it must never reach the executor.
+                    debug_assert!(
+                        false,
+                        "ResolveCrossConnection is intercepted by the msg2 \
+                         handler and must never reach the executor"
+                    );
+                }
                 PeerAction::SwapSendState { .. } => {
                     // Initiator cutover: the live authoritative rekey-cadence
                     // path, routed here from `check_rekey` via