feat(gossip): prepare topic-bound Signed KV V3 pairing (G4 HOLD)

[dirvine]

V2 signs topic || payload without a boundary, so a relay can rewrite T versus T/state-sync without changing those signed bytes. This preparation adds an explicit V3 signer and strict verifier using x0x-msg-v3 || author[32] || topic_len:u16be || topic || payload, matching the wire contract in saorsa-gossip #48.

• Share V2/V3 framing with explicit version selection, bind the UTF-8 topic byte length, enforce the V3 1 MiB and ML-DSA-65 shape bounds, and reject cross-version relabeling.
• Dispatch 0x03 explicitly; reject unknown leading versions instead of parsing them as unsigned V1. Unsigned topics are consequently limited to 511 UTF-8 bytes. Ordinary publishers and KvStoreSync remain on V2.
• Add proposed ADR-0063 and docs/legacy-compat.md, recording the default-disabled adoption boundary (enabled = false) and the remaining gates. The explicit V3 API does not register topics, issue grants, or activate compatibility.

G4 HOLD; selected strategy is to wait for a verified 0.5.76+ release containing #48. Registry gossip 0.5.75 was published on 2026-08-27 from archive source 6e17f02047017f07f8aa1d82052cdeb2409dfbf1 (dirty metadata), before the #48 merge 5307e59270b2eead28e948b2206cf8cc04f149d5 on 2026-09-06. It lacks the V3 admission verifier. No git pin or Cargo dependency change is included. G1 HOLD: published ant-quic 0.27.48 lacks recv_with_generation and current_connection_generation.

Tests check canonical preimage bytes, both-direction topic-boundary rewrites, relabeling, deterministic unsigned-fallback attacks, malformed/truncated envelopes, author binding, size/shape bounds, default V2 publication, and production V3 signatures through gossip's identity crypto API. This is not execution of #48's SignedKvTopic verifier or acceptance of its roster/exact-topic policy; that integration remains a G4 exit condition.

G0 is MET only. G1–G8 remain open. Receive provenance, guarded egress, policy/registration, KV routing and receive/apply audit, real-daemon/mixed-version/convergence gates, and operator enablement are pending. The upstream audited-receiver string's pubsub 0.5.66 component also needs reconciliation before adoption.

Separate draft for #517; #515 stays draft. No merge or daemon/deployment work.

Validation on tree e6db919bbbe117b15ad4793e2dd8a97b14c8f0e1, all exit 0 in this order:

1. cargo fmt --all
2. cargo clippy --all-features --all-targets -- -D warnings
3. cargo clippy --all-features --lib --bins -- -D warnings -D clippy::panic -D clippy::unwrap_used -D clippy::expect_used
4. cargo check --workspace --all-targets
5. cargo nextest run --all-features --lib -E 'test(gossip::pubsub::) | test(storm_control::)' — 75 passed; 2641 unrelated tests filtered out. macOS ld emitted a lib-test unwind-table size warning; linking and tests succeeded. No daemon tests were run.

[dirvine]

Independent source review at47458f57bec2be27a0451ed88e18e23568f13c4f: CLEAN for the V3 preimage/framing, strict verification and dispatch, retained ordinary V2 publication, signing/local-topic refusal and existing delivery revocation checks. Compared canonical preimage, ML-DSA shape and envelope ceiling against actual merged gossip48 source. The tests exercise the relevant framing/relabeling/size cases; I inspected them but did not execute them in this review. Live CI currently22success/2skipped on this head.

This remains preparation-only. ADR0063 is Proposed; the deliberate unsigned-V1 topic restriction and adoption policy await human engineering review. Actual SignedKvTopic roster/exact-topic admission, transport provenance/guarded egress, published dependencies, real-daemon/mixed-version/ten-run acceptance and enablement are still open. No merge or release approval is implied.