feat(peer): Leg B relayed connect responder + nat_identity injection (#1532) [BLOCKED: dig-nat 0.11 cascade]

[MichaelTaylor3d]

Closes #1532 (Leg B relayed-connect responder half; the #836 flywheel connect finish).

Status: BLOCKED on a release-first cascade — do NOT merge (does not compile yet)

dig-nat 0.11.0 ships the responder API (RelayStatus::enable_accept + RelayAcceptor), but the rest of the peer stack was NOT re-released onto 0.11:

crate	version	dig-nat req
dig-gossip	0.14.0 (rev 31f3f33)	"0.10"
dig-dht	0.5.0	"0.10"
dig-download	0.6.0	"0.10"
dig-peer-selector	0.5.0	"0.10"

"0.10" = ^0.10 = >=0.10,<0.11, which EXCLUDES 0.11. dig-node-core needs 0.11 (for enable_accept), the stack needs 0.10 → two dig-nat versions coexist → type mismatch at the dig-gossip boundary:

error[E0308]: mismatched types
  expected `dig_nat::relay::RelayStatus` (0.10), found `dig_nat::RelayStatus` (0.11)
  1609 | pub fn attach_relay_status(&self, status: Arc<dig_nat::relay::RelayStatus>)
  expected `dig_gossip::NatConfig`, found `dig_nat::NatConfig`
error: could not compile `dig-node-core` due to 3 previous errors

Required first (release-first, bottom-up, orchestrator-coordinated): widen the dig-nat requirement to allow 0.11 (0.11 is additive/API-compatible) and re-release dig-dht → dig-download → dig-peer-selector → dig-gossip (new tag), THEN this branch resumes.

dig-node-side changes on this branch (correct + ready; compile+green once the stack is on 0.11)

1. Deps: dig-nat 0.11, dig-gossip v0.14.0 (rev 31f3f33), 3-rev [patch.crates-io] lockstep, Cargo.lock (exactly one dig-gossip stanza verified). version → 0.55.0.
2. nat_identity injection — apply_persistent_identity(&mut cfg, &identity) sets the advertised pool peer_id from the persistent NodeCert SPKI AND injects the SAME NodeCert as GossipConfig::nat_identity (one identity across all transports; the Leg-B mismatch fix).
3. Relay responder — enable_accept() turned on before the reservation registers (no dropped circuits); spawn_relay_accept_loop hands each introduced RelayTunnel to RelayAcceptor::accept and serves the resulting session via serve_accepted_relay_conn (identical to a direct inbound), bounded by the accepted-connection semaphore.
4. Item 4 (relay reservation with the persistent cert): already satisfied — the reservation is opened with peer_id_hex derived from the persistent NodeCert (run_relay_connection registers that advertised peer_id; the reservation wire is a WebSocket, not mTLS, so it takes the peer_id string, not a cert).
5. TDD: apply_persistent_identity_makes_one_identity_span_all_transports; serve_accepted_relay_conn_serves_a_peer_rpc_over_an_authenticated_session (real mTLS, dig-nat Direct client → accepted-circuit server → peer RPC answered).

Blast radius (checked)

wire_relay_reservation (return type now (status, Option<Receiver>); one internal caller + one test updated), the gossip config build in run_peer_network, new spawn_relay_accept_loop/serve_accepted_relay_conn/apply_persistent_identity. No public dig-node API removed/renamed.

🤖 Generated with Claude Code