feat(overlay): 覆盖网络线序①–⑮ 代码与测试产物入库

覆盖网络线累积产物（此前只在工作区、未入版本库）：
- 新增 relay 子系统 src/net/relay/**（wire/duplex/server/client/dialer/switcher/directory/identity/keys/placement/network/addr-override/main/index）
- 新增 src/worker/relay-tunnel.ts、src/web/routes/overlay.ts
- 新增观测/演练脚本 overlay-probe、overlay-failover-drill、overlay-keyring、overlay-holepunch、overlay-jitter、overlay-wan、overlay-relaykey-add、relay-mem-calibrate
- 新增测试 12 个（relay / relay-failover / remote-spawner / instance-port / overlay-{network,auth,bootstrap,identity} / remote-user-fs 等）

验收基线：npm test = 162 pass / 0 fail / 1 skip；--scene all = 12 PASS / 0 SKIP / 0 FAIL；overlay-probe = 12/12

src/net/relay/index.ts

@@ -0,0 +1,88 @@
+/**
+ * 覆盖网络中继（relay）—— **自研、零新增依赖、零新增公网口**（传输方案 §10 定案）。
+ *
+ * ## 一段话说完它是什么
+ * worker 侧 `RelayClient` **只拨出**一条 wss；`RelayServer` **只绑回环**，为每个注册端口在
+ * `127.0.0.1` 上开一条监听；Manager 连那条回环口 ⇒ 字节经多路复用跑回 worker 本地端口。
+ * 对 Manager 而言地址形态与 sshd 版**完全同形**（`host:port`），所以换它是 env 级动作。
+ *
+ * ## 三条硬约束（来自实测，改动前先读）
+ * 1. **零新增公网口**：47 无本机防火墙（`nft INPUT policy accept`）⇒ 绑 `0.0.0.0` 即公网可达。
+ * 2. **worker 只拨出**：任何"在 worker 上开监听"的方案都让暴露面从 O(1) 变 O(N)。
+ * 3. **精确 ACK**：注册与开流都必须有确认帧，未确认即断并计数 —— 治的是 SSH 版"静默失败"的病根。
+ *
+ * @module dshs/net/relay
+ */
+
+export { RelayServer, RELAY_PATH, DEFAULT_RELAY_PORT, DEFAULT_AUTH_DEADLINE_MS, DEFAULT_AUTH_WINDOW_MS, DEFAULT_IDLE_TIMEOUT_MS, DEFAULT_HB_SEC, DEFAULT_MAX_STREAMS_PER_PORT, DEFAULT_QUEUE_MAX_BYTES } from './server.js'
+export type { RelayServerOptions, RelayStatus } from './server.js'
+export { RelayClient, describeClientStatus, gracefulBurstMsDefault, openedChannelFailedTerminally, waitUpOnStatus } from './client.js'
+export type { RelayClientOptions, RelayClientStatus, RelayClientState, WebSocketLike, WebSocketCtor, WaitUpStatusOptions } from './client.js'
+export { RelayRendezvous } from './rendezvous.js'
+export type { RelayRendezvousOptions } from './rendezvous.js'
+export { RelayDialer } from './dialer.js'
+export type { RelayDialerOptions } from './dialer.js'
+export { RelayFailoverSupervisor, relayFailoverThresholds } from './switcher.js'
+export type {
+  RelayChannelHandle,
+  RelayFailoverDeps,
+  RelayFailoverStats,
+  RelayFailoverThresholds,
+} from './switcher.js'
+export { MuxDuplex } from './duplex.js'
+export type { MuxDuplexOptions } from './duplex.js'
+export { MUX, WS_CLOSE, acceptWebSocket, encodeMux, decodeMux, encodeJsonFrame, parseJsonPayload, WsConnection } from './wire.js'
+export type { MuxFrame, MuxType, WsServerOptions } from './wire.js'
+export { OPS_NETWORK, NAME_SEP, assertNetworkId, assertSameNetwork, describeDialers, isHostId, isNetworkId, logicalName, normalizeDialers, parseLogicalName, sameNetwork } from './network.js'
+export { DIRECTORY_PATH, DIRECTORY_PAYLOAD_TAG, DIRECTORY_VERSION, DEFAULT_OVERLAY_SEED, buildDirectoryDocument, directoryPayload, directoryUrlFor, overlayEnvSeeds, overlayEnvTrustedKeys, parseDirectory, publicKeyFrom, publicRelayEntries, readCachedDirectory, resolveOverlayRelay, listOverlayRelayCandidates, signDirectory, toRelayUrl, verifyDirectory, writeCachedDirectory } from './directory.js'
+export type { CachedDirectory, DirectoryVerdict, OverlayAddressSource, OverlayDirectory, OverlayRelayCandidates, OverlayRelayResolution, ResolveOverlayRelayOptions } from './directory.js'
+export { keyEntryOf, loadKeysFile, parseKeysInline, normalizeKeyRecord, lookupKey, describeKeyEntry, assertKey } from './keys.js'
+export type { RelayKeyEntry, RelayKeyMap } from './keys.js'
+export {
+  IDENTITY_VERSION,
+  NODE_GRANT_TAG,
+  REVOCATION_TAG,
+  SIGNER_SET_TAG,
+  PROOF_TAG,
+  DEFAULT_NODE_KEY_FILE,
+  generateAuthorityKey,
+  generateNodeKey,
+  identityEnvRequire,
+  identityEnvTrustedRoots,
+  identityEnvTrustedSigners,
+  loadNodeGrant,
+  loadOrCreateNodeKey,
+  loadRevocations,
+  loadTrustedSigners,
+  nodeGrantPayload,
+  nodeKeyFingerprint,
+  normalizePublicKey,
+  parseNodeGrant,
+  parseRevocationList,
+  parseSignerSet,
+  proofPayload,
+  publicKeyOfPrivate,
+  readSignedFile,
+  revocationPayload,
+  signNodeGrant,
+  signProof,
+  signRevocations,
+  signSignerSet,
+  signerSetPayload,
+  verifyNodeGrant,
+  verifyPeerGrant,
+  verifyProof,
+  verifyRevocations,
+  verifySignerSet,
+  writeSignedFile,
+} from './identity.js'
+export type {
+  IdentityReason,
+  IdentityVerdict,
+  NodeGrant,
+  PeerVerifyContext,
+  RevocationList,
+  SignerSet,
+} from './identity.js'
+export { chooseNode, describeDecision, rankCandidates, scoreCandidate } from './placement.js'
+export type { ChooseOptions, NodeCandidate, PlacementDecision, PlacementScore, PlacementWeights } from './placement.js'