redial disconnected cluster peers and remove dead ones

[fabracht]

Summary

• dead peer entries were never removed and never re-dialled, so a peer that dropped stayed unreachable until an inbound connection happened to replace the entry (cluster: congestion-drop reconciliation and stale-peer redial after writer-task death #146 redial half; part of cluster: nodes never dial peers they discover, never retry failed dials, and never drop dead peers #140)
• each peer connection carries a monotonic in-memory generation; a send-side write failure removes the entry guarded by that generation, so a stale failure never drops a newer reconnected connection
• the 60s mesh-check tick re-dials every configured (--peers) peer the heartbeat view reports as not alive; connect_to_peer replaces any stale entry, so redial does not depend on the removal having fired first
• scope is configured peers only; discovering non-configured peers needs address gossip and stays cluster: nodes never dial peers they discover, never retry failed dials, and never drop dead peers #140
• design modelled and quorum-verified in TLA+ (specs/ClusterRedial.tla): guarded + monotonic-id removal is ABA-safe and self-healing; by-key removal, a reusable id, or no redial each break it; and redial over a still-live connection stays ABA-safe

Test plan

• cargo make clippy (pedantic, all feature combos)
• cargo make test (1203 tests, 0 failures)
• dead_peer_is_removed_and_redialled integration test (send-side failure removes the peer; redial reconnects it)
• TLA+ specs/ClusterRedial.tla: safe cfg holds safety + liveness; unguarded / reusable-id / no-redial each produce the expected counterexample; overlive cfg confirms InvNoLiveDrop holds when redial fires over a still-live connection
• live 5-node cluster E2E, fresh cluster per victim (nodes 3, 1-leader, 5): each crashed and restarted accept-only, all 4 survivors re-dialled it, mesh healed to 5/5, cross-node op through the rejoined node recovered (3/3)

Follow-ups (non-blocking, #140/robustness track — see companion issue)

• reconnection latency up to ~75s (15s heartbeat dead-detect + 60s mesh tick)
• redial keys on strict Alive, so a briefly-Suspected but healthy peer is eligible for a bounded, safe re-dial once per tick; could gate on Dead/Unknown only
• hard-crash peer-map removal waits on quinn's ~30s idle timeout (removal is non-load-bearing for reconnection)
• no per-dial timeout, so a black-hole peer serializes a tick's remaining redials
• no address-change handling (static --peers; address gossip / discovery is cluster: nodes never dial peers they discover, never retry failed dials, and never drop dead peers #140)

closes #146