node/lifecycle: wire the runtime child-exit producer

Wire exit detection for the four directly-observable optional children so
the supervisor FSM's ChildExited edge fires at runtime. A runtime
child-liveness mpsc channel carries a Child on exit: the DNS task and the
two TUN threads self-report when their body returns, and a 2s poll monitor
reports mDNS and Nostr via new is_finished accessors. The rx_loop gains a
select arm that steps the FSM and republishes health (Degraded, since a
running node always has at least one transport up). Transports and worker
pools expose no runtime-exit signal and are left for a follow-up.

Adds LanRendezvous::is_finished and NostrRendezvous::is_finished; the
latter treats a shutdown-taken connect_task as finished so the monitor
terminates after a stop instead of polling forever.

src/node/dataplane/rx_loop.rs

@@ -95,6 +95,18 @@ impl Node {
             }
         };
 
+        // Take the runtime child-liveness receiver, or a dummy channel (when the
+        // node was seeded straight into Running without a start()). Holding the
+        // dummy sender in the guard keeps the channel open. Same pattern as TUN
+        // outbound / DNS identity.
+        let (mut child_exit_rx, _child_exit_guard) = match self.child_exit_rx.take() {
+            Some(rx) => (rx, None),
+            None => {
+                let (tx, rx) = tokio::sync::mpsc::channel(1);
+                (rx, Some(tx))
+            }
+        };
+
         let mut tick =
             tokio::time::interval(Duration::from_secs(self.config().node.tick_interval_secs));
 
@@ -251,6 +263,27 @@ impl Node {
                         }
                     }
                 }
+                // Runtime child-liveness. Placed AFTER `packet_rx` so the hot
+                // inbound path keeps its `biased` priority. A directly-observable
+                // child (TUN threads, DNS/mDNS/Nostr) exited on its own; feed the
+                // FSM, which republishes health (Degraded here — a Running node
+                // always has ≥1 transport up). `on_child_exited` only ever emits
+                // `PublishState`; other variants are ignored defensively.
+                maybe_child = child_exit_rx.recv() => {
+                    if let Some(child) = maybe_child {
+                        let actions = self
+                            .supervisor
+                            .fsm
+                            .step(crate::node::lifecycle::supervisor::Event::ChildExited { child });
+                        for action in actions {
+                            if let crate::node::lifecycle::supervisor::Action::PublishState(ns) =
+                                action
+                            {
+                                self.supervisor.state = ns;
+                            }
+                        }
+                    }
+                }
                 Some(ipv6_packet) = tun_outbound_rx.recv() => {
                     self.handle_tun_outbound(ipv6_packet).await;
                     let mut drained = 0;