session: mirror proactive PathMtuNotification into path_mtu_lookup

The TUN-side TCP MSS clamp consults `path_mtu_lookup` (FipsAddress-
keyed) when sizing outbound TCP flows. Until now, only the reactive
`MtuExceeded` handler mirrored the bottleneck MTU into that store;
the proactive end-to-end `PathMtuNotification` echoed by the
destination updated only `MmpSessionState.path_mtu`, leaving the TUN
mirror stale.

On stable long-lived paths, the proactive echo can tighten the
session-canonical MTU well before any transit router fires a
`MtuExceeded` for those flows (since all current traffic is already
sized by the tighter session value). New TCP flows opened during
that window get clamped by the discovery-time value rather than the
session-canonical one, leading to PMTU-D loss until the reactive
path eventually fires.

Mirror the post-apply MTU into `path_mtu_lookup` whenever
`apply_notification` returns true, with the same tighter-only
semantics as the reactive mirror — never loosen the clamp. Gated on
the bool return so spurious writes don't happen on rejected
increases or no-op same-value notifications.

Four new unit tests exercise the empty-lookup write, tighten-
existing, keep-tighter-existing, and no-session-no-op paths,
parallel to the existing reactive-mirror test trio.

CHANGELOG.md

@@ -392,6 +392,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   the TUN-side `path_mtu_lookup` so later flows pick up forward-path
   bottlenecks without re-discovery. Windows TUN reader receives the
   same per-destination plumbing.
+- Proactive end-to-end `PathMtuNotification` now mirrors into the
+  TUN-side `path_mtu_lookup` (TCP MSS clamp store), parallel to the
+  reactive `MtuExceeded` mirror that already existed. Previously the
+  proactive handler only updated the session-canonical
+  `MmpSessionState.path_mtu`; on stable long-lived paths where the
+  destination's echo had tightened the session MTU but no transit
+  router had emitted a fresh `MtuExceeded` (because all current
+  traffic was already sized by the tighter session value), new TCP
+  flows opened in that window kept getting clamped by the staler
+  discovery-time value. The proactive mirror closes that gap with
+  the same tighter-only semantics — never loosens the clamp.
 - Auto-connect peers now reconnect after a graceful `Disconnect`
   notification from the remote side. `handle_disconnect` previously
   removed the peer without scheduling a reconnect, orphaning the