Merge branch 'refactor-node' into refactor-node-next

Re-express the handshake-state carrier collapse onto the XX code: the leg's
handshake_state field is deleted and the displayed state is derived from the
peer machine's phase, with failure carried on the machine (a send_failed flag
that preserves the handshake phase) rather than on the leg. The next projection
maps the SentMsg2 responder phase to received_msg1 and the anonymous-dial
Discovered phase to sent_msg1; the three initiator send-failure sites carry
failure via send_failed. Telemetry strings, wire bytes, index allocation, and
stale-connection reaping are byte-identical to next.

src/node/tests/handshake.rs

@@ -792,7 +792,6 @@ async fn test_failed_connection_cleanup() {
     conn.set_our_index(our_index);
     conn.set_transport_id(transport_id);
     conn.set_source_addr(remote_addr.clone());
-    conn.mark_failed(); // Simulate send failure
 
     let link = Link::connectionless(
         link_id,
@@ -808,6 +807,24 @@ async fn test_failed_connection_cleanup() {
     node.pending_outbound
         .insert((transport_id, our_index.as_u32()), link_id);
 
+    // Simulate a stored-handshake send failure through the control machine —
+    // the failure carrier the stale-connection sweep now reads (the leg no
+    // longer carries a failed phase of its own).
+    {
+        let machine = node
+            .peer_machines
+            .get_mut(&link_id)
+            .expect("machine seeded by add_connection");
+        let alloc = &mut node.index_allocator;
+        let actions = machine.step(
+            crate::peer::machine::PeerEvent::HandshakeSendFailed,
+            now_ms,
+            alloc,
+        );
+        assert!(actions.is_empty());
+        assert!(machine.is_failed());
+    }
+
     assert_eq!(node.connection_count(), 1);
 
     // Failed connections should be cleaned up immediately regardless of age