Add TCP transport implementation and test harness support

Implement TCP transport for FIPS enabling firewall traversal and serving
as the foundation for future Tor transport. This is the first
connection-oriented transport in the system.

Key design decisions:
- FMP header-based framing: reuses existing 4-byte FMP common prefix for
  packet boundary recovery with zero framing overhead
- Session survives TCP reconnection: Noise/MMP/FSP state bound to npub,
  not TCP connection; MMP liveness is sole authority for peer death
- Connect-on-send: fresh connection on first send, transparent reconnect
- close_connection() trait method for cross-connection deduplication cleanup

New transport files:
- src/transport/tcp/mod.rs: TcpTransport, connection pool, accept loop
- src/transport/tcp/stream.rs: FMP-aware stream reader (shared with Tor)

Modified: transport trait (close_connection), TcpConfig, TransportHandle
match arms, create_transports(), initiate_connection() for connection-
oriented links, cross-connection tie-breaker cleanup, design docs.

Tree announce loop and TCP stability fixes:
- Preserve tree announce rate-limit state across reconnection: carry
  forward last_tree_announce_sent_ms when a peer reconnects so the
  rate-limit window isn't reset to zero
- Drop oversize TCP packets at sender: pre-send MTU check returns
  MtuExceeded instead of writing to the stream, preventing receiver-side
  connection teardown and reset-reconnect cycles

Chaos harness:
- TCP transport support: tcp_edges/has_tcp/tcp_peers in SimTopology,
  transport-aware config_gen with per-edge transport type, TCP port 443,
  pure-TCP node support
- Include all non-Ethernet edges in directed_outbound()
- Fix netem/links log messages to say "IP-based" instead of "UDP"
- Add tcp-chain, tcp-only, and tcp-mesh scenario files

Static harness:
- Transport-aware config generation (get_default_transport, transport_port)
- TCP transport injection via Python post-processing
- Add tcp-chain topology and docker-compose profile

src/node/lifecycle.rs

@@ -157,13 +157,28 @@ impl Node {
         // Allocate link ID and create link
         let link_id = self.allocate_link_id();
 
-        let link = Link::connectionless(
-            link_id,
-            transport_id,
-            remote_addr.clone(),
-            LinkDirection::Outbound,
-            Duration::from_millis(self.config.node.base_rtt_ms),
-        );
+        // Use Link::new() for connection-oriented transports (Connecting state)
+        // and Link::connectionless() for connectionless transports (Connected state)
+        let link = if self.transports.get(&transport_id)
+            .map(|t| t.transport_type().connection_oriented)
+            .unwrap_or(false)
+        {
+            Link::new(
+                link_id,
+                transport_id,
+                remote_addr.clone(),
+                LinkDirection::Outbound,
+                Duration::from_millis(self.config.node.base_rtt_ms),
+            )
+        } else {
+            Link::connectionless(
+                link_id,
+                transport_id,
+                remote_addr.clone(),
+                LinkDirection::Outbound,
+                Duration::from_millis(self.config.node.base_rtt_ms),
+            )
+        };
 
         self.links.insert(link_id, link);