fix: DGR-033 repair native worker protocol per cross-review BLOCK

Address the Codex GPT-5.5 review of the standalone fake C++ gRPC Shard
worker. Four root protocol defects fixed:

- Fail closed before SessionOpen: a per-session `opened` flag gates
  chunk/decode so no activation bypasses lifecycle, cancellation, epoch
  or flow-control state (terminal ERROR_CODE_INTERNAL), even when an
  out-of-band Cancel created placeholder state.
- Strict flow-control negotiation: NegotiateFlow takes the strictest of
  peer-vs-worker bounds (mirrors codec.negotiate_flow_control) and the
  negotiated per-session max_chunk_bytes is enforced on every bundle
  instead of trusting the peer proposal.
- In-stream ReleaseSignal now erases session state immediately.
- SessionOpen rejects incompatible schema, fingerprint, and shard-range
  identity and reports the worker's own served fingerprint rather than
  echoing the caller.

Adds 9 regression tests (worker suite 18 -> 27). Real gates on the
rebuilt pinned-gRPC binary: cmake build exit 0; ctest 2/2; worker
pytest 27 passed; harness+protocol 63 passed; compileall 0; diff --check
clean; ldd/nm show 0 llama/ggml linkage. DGR-033 passes -> true.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/node/native/worker/fake_engine.h

@@ -78,18 +78,22 @@ class FakeShardEngine {
   // (DGR-036) can assert this is a fixture, not a real engine.
   static constexpr const char* kEvidenceClass = "fixture";
 
-  explicit FakeShardEngine(uint64_t max_chunk_bytes) : max_chunk_bytes_(max_chunk_bytes) {}
+  FakeShardEngine() = default;
 
-  BundleCheck Validate(const sp::TensorBundle& bundle) const {
+  // `max_chunk_bytes` is the per-session *negotiated* ceiling (the strictest of
+  // the worker's own limit and the peer's proposal), passed in on every call so
+  // the engine enforces exactly what the SessionOpen handshake settled — never a
+  // value the peer proposed unilaterally.
+  BundleCheck Validate(const sp::TensorBundle& bundle, uint64_t max_chunk_bytes) const {
     BundleCheck result;
     for (const auto& tensor : bundle.tensors()) {
       // Bounded message: a declared payload larger than the ceiling is refused
       // before any reassembly work is done.
-      if (max_chunk_bytes_ != 0 && tensor.total_bytes() > max_chunk_bytes_) {
+      if (max_chunk_bytes != 0 && tensor.total_bytes() > max_chunk_bytes) {
         result.oversize_detail =
             "tensor '" + tensor.name() + "': declared total_bytes " +
             std::to_string(tensor.total_bytes()) + " exceeds max_chunk_bytes " +
-            std::to_string(max_chunk_bytes_);
+            std::to_string(max_chunk_bytes);
         return result;
       }
 
@@ -154,9 +158,6 @@ class FakeShardEngine {
     }
     return digest;
   }
-
- private:
-  uint64_t max_chunk_bytes_;
 };
 
 }  // namespace meshnet::worker