Define mailbox peer overlay and transport interfaces #4632

Parent: #4622

Depends on #4627.

Outcome

Define separate mailbox overlay and byte-transport interfaces so logical MVM identity, route selection, and authorization remain independent from Iroh, HeatNet/UOR, QUIC, relays, and IP addressing.

The interfaces carry canonical mvm-contract::protocol::mailbox envelopes or bounded encoded bytes. They do not expose mvmd-types as protocol authority; mvmd route hints and placement records adapt into the overlay interface at the fleet boundary.

Scope

• PeerOverlay-equivalent behavior for resolving a stable mailbox or MVM identity to authorized route candidates.
• PeerTransport-equivalent behavior for authenticated connection establishment, bounded reliable streams, path classification, cancellation, and shutdown.
• An explicit boundary marker that routes any TUN/L3 or packet/frame implementation back to Research: evaluate per-VM vsock NIC adapters for vnet/HeatNet and SpiralCore #4607; this mailbox issue does not define or implement a virtual NIC.
• Rotatable transport bindings certified for an MVM identity, tenant, assurance tier, policy epoch, and validity window.
• In-memory implementations for deterministic protocol, partition, reconnection, and failure tests.

Acceptance criteria

• Mailbox protocol code depends on stable overlay/transport interfaces rather than concrete Iroh or HeatNet types.
• MVM, mailbox, execution, and transport identities cannot be accidentally substituted for one another.
• Authorization is enforced above the transport; successful connection establishment is not sufficient authority to deliver a message.
• Direct, relayed, reconnecting, partitioned, refused, and shutting-down paths have deterministic conformance tests.
• The interfaces expose bounded backpressure and cancellation without requiring a repository-wide async-runtime change.
• Prior mvmd AgentTransport work is documented as related implementation experience, not imported as a runtime dependency.
• The interface cannot be used to smuggle arbitrary packet forwarding into the mailbox authority or bypass Research: evaluate per-VM vsock NIC adapters for vnet/HeatNet and SpiralCore #4607's virtual-NIC decision.
• A conformance adapter demonstrates that optional mvmd routing metadata can select a path without changing, decrypting, or re-signing the canonical envelope.