feat(rustd): afd_wire speaks the current lease wire byte-for-byte

Section 3's Rust half. Fifty-six types across ten modules, and the suite that
proves them: each fixture is parsed and re-serialized, and the OUTPUT BYTES are
compared to what the Zig emitter wrote. That is stronger than field-by-field
equality — it pins field order, optional-emission, number spelling and enum
spelling, every way two encoders agree on a value and disagree on its encoding.

Three decisions worth the review time.

Borrowed, not owned. Text is Cow<'a, str> behind serde(borrow), so a payload
with no escapes parses without allocating a field while an escaped one still
decodes by falling back to an owned copy. Every lease, report, heartbeat and
activity frame crosses this layer; String everywhere would allocate per field
per request, and it is the one choice here expensive to reverse.

No afd_core dependency, deliberately. Wire types carry primitives because
validating at parse would break the very thing this layer guarantees:
WorkerCount clamps on deserialize, so a payload carrying worker_count 168 would
decode to 64 and re-serialize to 64 — a byte mismatch against a fixture the Zig
daemon, which clamps at assignment rather than parse, emits as 168.

Unknown-field policy comes from the manifest, not a blanket setting. Serde
IGNORES unknown fields by default while thirty of these types must reject them,
so each carries deny_unknown_fields exactly where the Zig call site does, and a
generated probe per type asserts observed leniency against what the emitter
recorded.

Seeded three defects to prove the suite is not vacuous: a swapped field order
and a renamed enum value both go red. A WIDENED integer does not — any value Zig
emits fits a wider Rust type and re-serializes identically — so that gap is named
in the tests and closed by a separate assertion that a value one past each
declared width is refused. Re-seeding the widening now fails that test while the
round-trip still passes, which is the honest division of labour.

Two clippy lints are overridden with #[expect] and a checkable reason rather than
silenced: Completed's empty braces ARE the wire encoding, since a unit struct
serializes as null, and CapabilityReport's four booleans are the peer's shape.
The round-trip test fails if either claim stops being true.

159 tests, 96.77% lines. Dimensions 3.1-3.4 and 4.4 marked DONE.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>