#128 fix: order watchdog receipts, close on failed replies, advertise real addresses

Part 4, the last part, of the protocol contract decided in #108.

• StateMachine's watchdog records receipts in order with their receipt
  time, in constant space: the newest activity and at most one DWA credit
  for the single outstanding DWR. Tw is rearmed from the receipt time, a
  DWA credit and the expiry decision are taken in one atomic step, and the
  window after a DWR starts when the DWR is actually published, so neither
  a backlog nor a slow write turns a healthy peer SUSPECT (RFC 3539
  §3.4.1, Appendix A).
• Both front ends close the connection, once, when a required reply (CEA,
  DWA, DPA or an error answer) cannot be built, queued or written, and
  report the reply status in order: queued before failed.
• CER and CEA advertise only configured or actually resolved addresses
  (RFC 6733 §5.3.5). The Manager no longer falls back to loopback when it
  cannot resolve one, so a custom transport may need Host-IP-Address
  configured; StateMachine still advertises loopback addresses that may
  really be used.

Fixes #108

Validation

• make check passes locally for all modules: format, test (Go 1.27.2 and
  1.26.9), race, vet, lint, vuln, windows, secrets and codeql.
• Fake-clock tests cover backlog, simultaneous timeout, activity and DWA, a
  stalled DWR write and a DWA admitted at the expiry boundary; TCP captures show
  no extra probe and no false SUSPECT, and CER/CEA advertising only real addresses.
• Three review rounds found unbounded receipt storage, a response window started
  before the DWR was published, Queued/Failed reported out of order and a receipt
  versus expiry race; all are fixed with their own tests, and the watchdog tests
  pass under -race -count=20.

---

Summary by cubic

Fixes the final part of the protocol contract for #108: ordering watchdog receipts, closing on required-reply failures, and advertising real addresses.

Watchdog

• Receipts are recorded in order with their receipt time, in constant space: the newest activity and at most one DWA credit for the single outstanding DWR.
• Tw is rearmed from the receipt time, the DWA credit and expiry decision are atomic, and the window starts when the DWR is published, so neither a backlog nor a slow write marks a healthy peer SUSPECT.

Required replies and addresses

• Both front ends close the connection once when a required CEA, DWA, DPA, or error answer cannot be built, queued, or written, and report queued before failed.
• CER and CEA advertise only configured or actually resolved addresses; the Manager no longer falls back to loopback (custom transports may need Host-IP-Address configured), while StateMachine still advertises loopback addresses that may really be used.