Harden SDK contract replay and reliable messaging

[waterbang]

Summary

• retain the CCCC 0.4.33 Web Model wait/complete contract on the current 0.4.34 SDK line, with a required stable delivery ID and replay fixture
• bound TypeScript connect/response/handshake phases to one deadline, honor handshake aborts, and validate byte buffers before UTF-8 decoding
• add Rust 0.0.2 identity-bound reliable send/reply/inbox APIs with durable monotonic cursor reconciliation
• add exact native 0.4.33 daemon jobs, Rust MSRV/Windows coverage, a hardening gate, and reproducible spec-ref tooling
• synchronize changelog, READMEs, release notes, and adaptation evidence

Why

Review found that completion replay lacked a caller-stable key, TypeScript stream phases could outlive their intended bound or remove unrelated listeners, and Rust did not represent native nullable cursors, duplicate writes, remote-ahead read state, or atomic checkpoint replacement.

Impact

No existing 0.4.34 API is removed. Python and TypeScript gain retained Web Model runtime wrappers. The Rust crate moves from 0.0.1 to 0.0.2 and adds a pinned tempfile dependency for cross-platform atomic cursor replacement.

Validation

• Python: 78 tests, source compilation, sdist/wheel build, Twine check
• TypeScript: 119 tests, strict typecheck, build, npm package dry-run
• Rust: 21 tests plus opt-in live test harness, fmt, Clippy, rustdoc, clean crate packaging and packaged-crate self-test
• Rust 1.74 MSRV and Windows target checks
• SDK hardening gate, pinned core spec comparison, shell/YAML/diff checks
• isolated Python, TypeScript, and Rust compatibility probes against CCCC 0.4.34-rc2