fix(akka): defensive ctor + per-actor mailbox in the harbour sample

Two related fixes for the global-default-mailbox bootstrap NRE:

- BowireAkkaExtension.ctor now wraps the DeadLetterListener spawn
  + EventStream subscribe in try/catch. When the BowireTapMailbox
  is wired as the *global* default-mailbox, it gets instantiated
  for the root guardian during bootstrap and triggers Apply on the
  extension before the actor system is itself navigable, which
  NREs inside SystemActorOf. We swallow that one path and leave
  _deadLetterListener null — the live mailbox tap still works,
  only dead-letter capture goes silent in that config.

- Harbour sample now uses the surgical per-actor opt-in instead
  of the global default-mailbox swap. Defines a named mailbox
  (akka.actor.bowire-tap) and tags the three application actors
  with .WithMailbox(...). Avoids the bootstrap entanglement
  entirely and is what the README recommends for production use.

Author: thomas-stegemann

samples/Kuestenlogik.Bowire.Protocol.Akka.Sample/Program.cs

@@ -21,8 +21,16 @@
 //   2. Pick the "Akka.NET" protocol tab
 //   3. Stream the Tap → MonitorMessages method
 
+// Define a NAMED mailbox config (akka.actor.bowire-tap) and opt our
+// three application actors into it via Props.WithMailbox below — this
+// is the surgical opt-in pattern from the plugin README. Setting the
+// default-mailbox globally would also rewrap the system's own root
+// guardian + dead-letters mailbox during bootstrap, which loads the
+// BowireAkkaExtension before the actor system is navigable.
 const string TapHocon = """
-    akka.actor.default-mailbox.mailbox-type = "Kuestenlogik.Bowire.Protocol.Akka.BowireTapMailbox, Kuestenlogik.Bowire.Protocol.Akka"
+    akka.actor.bowire-tap = {
+        mailbox-type = "Kuestenlogik.Bowire.Protocol.Akka.BowireTapMailbox, Kuestenlogik.Bowire.Protocol.Akka"
+    }
     """;
 
 var builder = WebApplication.CreateBuilder(args);
@@ -38,9 +46,11 @@
 
 // Master gets bound to the dock after construction (forward-decl), so
 // PortCallClosed can flow back. Order: crane → master → dock → bind.
-var crane = system.ActorOf(CraneActor.Build(), "crane-A1");
-var master = system.ActorOf(HarborMasterActor.Build(), "harbor-master");
-var dock = system.ActorOf(DockActor.Build(crane, master), "dock-1");
+// Each actor opts into the BowireTapMailbox via WithMailbox so the
+// system-internal actors keep their default mailbox.
+var crane = system.ActorOf(CraneActor.Build().WithMailbox("akka.actor.bowire-tap"), "crane-A1");
+var master = system.ActorOf(HarborMasterActor.Build().WithMailbox("akka.actor.bowire-tap"), "harbor-master");
+var dock = system.ActorOf(DockActor.Build(crane, master).WithMailbox("akka.actor.bowire-tap"), "dock-1");
 master.Tell(new BindDock(dock));
 
 // Background scheduler — random ship every 2 s.

src/Kuestenlogik.Bowire.Protocol.Akka/BowireAkkaExtension.cs

@@ -36,7 +36,7 @@ public sealed class BowireAkkaExtension : IExtension
 {
     private readonly object _lock = new();
     private readonly List<Channel<TappedMessage>> _subscribers = [];
-    private readonly IActorRef _deadLetterListener;
+    private readonly IActorRef? _deadLetterListener;
     private readonly string _deadLetterPath;
 
     /// <summary>The actor system this extension instance belongs to.</summary>
@@ -47,14 +47,33 @@ internal BowireAkkaExtension(ExtendedActorSystem system)
         System = system;
         _deadLetterPath = system.DeadLetters.Path.ToString();
 
-        // Subscribe a lightweight internal actor to the EventStream for
-        // DeadLetter notifications. We use an actor (rather than a raw
-        // delegate) because Akka.NET's EventStream API is actor-based —
-        // ActorOf gives us automatic lifecycle handling.
-        _deadLetterListener = system.SystemActorOf(
-            Props.Create(() => new DeadLetterListener(this)),
-            "bowire-deadletter-listener");
-        system.EventStream.Subscribe(_deadLetterListener, typeof(DeadLetter));
+        // Spawn a private system actor that bridges the EventStream's
+        // actor-based DeadLetter notifications to PublishDeadLetter.
+        //
+        // Wrapped in try/catch: if the BowireTapMailbox is configured
+        // as the *global* default mailbox (akka.actor.default-mailbox),
+        // the mailbox is created for the root guardian during bootstrap
+        // and triggers Apply on this extension before the actor system
+        // is itself navigable. SystemActorOf NREs in that path. The
+        // surgical opt-in pattern (per-actor `Props.WithMailbox` or a
+        // named mailbox config like `akka.actor.bowire-tap`) avoids the
+        // bootstrap entanglement, but we degrade gracefully so a global
+        // default-mailbox swap still gives you the live tap stream
+        // (just without dead-letter capture).
+        try
+        {
+            _deadLetterListener = system.SystemActorOf(
+                Props.Create(() => new DeadLetterListener(this)),
+                "bowire-deadletter-listener");
+            system.EventStream.Subscribe(_deadLetterListener, typeof(DeadLetter));
+        }
+        catch
+        {
+            // System not navigable yet (root-guardian bootstrap path).
+            // Live mailbox taps still work; dead-letter capture is the
+            // only thing missing in that mode.
+            _deadLetterListener = null;
+        }
 
         // Tear down the subscription when the system shuts down so we
         // don't leak the EventStream registration. IExtension has no
@@ -63,7 +82,10 @@ internal BowireAkkaExtension(ExtendedActorSystem system)
         {
             try
             {
-                System.EventStream.Unsubscribe(_deadLetterListener, typeof(DeadLetter));
+                if (_deadLetterListener is { } listener)
+                {
+                    System.EventStream.Unsubscribe(listener, typeof(DeadLetter));
+                }
             }
             catch
             {