harden: persist outbound anti-replay counter + rendezvous re-seal/re-send + sender_epoch

[MichaelTaylor3d]

Three follow-ups from SG-2 (#991, DIG-Network/dig_ecosystem):

1. Outbound anti-replay counter is per-process in-memory (RefCell) — persist it across restarts when the sealer wires to real dig-app storage (else a restart resets the counter; a replay window opens for the recipient whose inbound ReplayGuard also reset). dig-app persistence concern.
2. SG-1 rendezvous re-send gap — in manager.request, an offline peer parks the connection but the sealed offer built in request is DISCARDED + resume_peer does not re-seal/re-send it. Confirm the rendezvous actually re-delivers the offer (else offline offers silently drop).
3. sender_epoch fixed at 0 — resolve_bls_public_key has no epoch param yet; key-rotation epoch handling is future dig-identity/dig-message work; thread it when available.
   Ref DIG-Network/dig_ecosystem#991/#990. Hardening.