workspace: exclude the imported offchain and solana trees

Both keep their own Cargo.toml, Cargo.lock and rust-toolchain.toml and
build as nested workspaces, exactly as they did in their own repos. Step 4
of the monorepo migration folds offchain into the root workspace. The
solana tree stays excluded because 62 of its 96 closure crates resolve
differently under a shared lockfile.

Author: bgm-malbeclabs

CHANGELOG.md

@@ -14,6 +14,8 @@ All notable changes to this project will be documented in this file.
 - CI
   - The new `release-bump-dry-run` job dry-runs the release version bump on every PR, so a `cargo update --workspace` dependency rebind fails on the PR that causes it instead of a week later at release time, as it did for v0.37.0 (#4213, fixed in #4219). Advisory until its context is added to the `main` ruleset. (#4220)
   - Add `.cursor/BUGBOT.md` to enable Cursor review. This is an experiment. (malbeclabs/infra#2387)
+- Repo
+  - `doublezero-offchain` and `doublezero-solana` are imported into this repo, with their history and their release tags, under new top-level `offchain/` and `solana/` directories. Nothing that was already here moves. Both trees stay excluded from the root Cargo workspace and keep their own `Cargo.toml`, `Cargo.lock` and `rust-toolchain.toml`, so they build exactly as they did in their own repos, and their workflows do not run yet. The source repos are still the ones that release. (malbeclabs/infra#1952)
 - CLI
   - `doublezero connect` with no mode provisions everything the server's AccessPass authorizes in one run — the IBRL tunnel plus a multicast tunnel joined to the groups or purchased feeds the pass grants — instead of requiring the operator to know their entitlements and issue `connect ibrl` and `connect multicast` separately. Each mode is reported on its own line; one the pass does not cover is skipped with the reason rather than failing the run. The two are attempted independently, so a failure in one keeps the other's work and names the command that finishes the rest, and the run exits non-zero if an attempted mode failed or the pass authorized nothing. Epoch expiry still gates unicast only, so an expired pass connects multicast and skips IBRL. The bare form also enables the reconciler up front, so a run that provisions nothing still leaves the daemon managing tunnels, and takes `--tenant`/`--allocate-addr` for its IBRL half (`connect ibrl` keeps its own positional tenant and `-a`). `connect ibrl` and `connect multicast` are unchanged.
   - `doublezero balance` takes an optional address, so `doublezero balance <pubkey>` reports that account's balance while the bare form keeps reporting the configured keypair's. Querying another account needs no local keypair. An address that was never funded prints `0 Credits` instead of failing the account lookup.

Cargo.toml

@@ -20,6 +20,10 @@ members = [
 ]
 default-members = []
 exclude = [
+    # Both trees keep their own workspace, lockfile and toolchain until step 4
+    # of the monorepo migration merges them in.
+    "offchain",
+    "solana",
     "sdk/revdist/testdata/fixtures/generate-fixtures",
     "sdk/serviceability/testdata/fixtures/generate-fixtures",
     "sdk/telemetry/testdata/fixtures/generate-fixtures",