Verify node↔control↔gateway connection end to end (with numbers)

[Lothnic]

Tests and measures the full meridian-node ↔ meridian-control ↔ gateway path over a real socket with mTLS enforced (require_mtls=True).

What

• tests/control/test_cross_repo_gateway.py — a durable end-to-end test: the real node agent enrolls, is rejected without a cert (NODE_NOT_AUTHORIZED) and accepted after presenting it, heartbeats, and posts a Ready-engine observation; the gateway's ManagedProjectionSync then registers that engine as a routable backend eligible for its served model (managed:<node>:engine_1).
• scripts/verify_connection.py — a numbers harness that runs the same path and prints measured latencies/counts instead of a boolean.

Measured (this machine, localhost, mTLS on)

enroll (token)         37.9 ms
mTLS enforcement       no-cert rejected NODE_NOT_AUTHORIZED; cert session epoch=1 in 20.0 ms
heartbeat x50          min 23.7 / mean 24.6 / p95 25.9 / max 26.1 ms; last_seq=50
desired publish+fetch  gen=7 fetched in 3.8 ms
observation post       19.4 ms (1 Ready engine, model=demo/model)
control projection     1 endpoint, 1 routable, 6.4 ms
gateway registration   backends 0 -> 1; eligible['demo/model'] = managed:<node>:engine_1
cert rotation          rotated in 19.6 ms; cert changed; post-rotation heartbeat seq=52
RESULT: PASS — full path verified end to end

Suite totals (all green)

node 81 passed · gateway 540 passed · control+cross-repo 29 passed; ruff + mypy clean.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.