fix: backlog sweep — send protocol-flags form, TARA/tara collision, subscribe race, spec v1.11

[SoundMatt]

Summary

Fixes the entire open-issue backlog on this repo (#28–#34), all P1/P2 findings from the 2026-07-27 RELAY ecosystem audit, plus leaves the one architectural-decision issue (#23) open with an explanation.

Fixed

• [P1] CLI send is declared in capabilities but does not implement the section-11.2 protocol-flags form (--zone/--type/--payload) for RCP #28 (P1, spec-conformance) — send was declared in capabilities but only implemented the streaming NDJSON sink; the §11.2 protocol-flags form (--zone <name> --type <cmdtype> [--payload <hex>]) was rejected as invalid args. Implemented send_one() alongside the existing send_stream(), dispatching to the same in-process mock registry. Added hex_decode() and cmd_type_from_string() helpers and 6 new test cases in tests/test_cli.cpp.
• [P1] TARA.md and tara.md are two different tracked files differing only by case - collide and silently drop content on case-insensitive filesystems #29 (P1, bug) — TARA.md (hand-authored ISO 21434 narrative) and tara.md (cpfusa-generated summary) case-collide on case-insensitive filesystems (macOS/Windows default), silently dropping one file's content on checkout — reproduced during this very session's clone. Renamed the hand-authored file to TARA-ANALYSIS.md (the one under this repo's control; tara.md's name is emitted by the external cpfusa tara command) and updated the two references in AUDIT_PACK.md and ROADMAP.md.
• [P2] mock::Controller::subscribe() has a TOCTOU race with close(): can return success instead of ErrClosed #30 (P2, bug) — mock::Controller::subscribe() checked closed_ and appended to subs_ under separate critical sections, so a subscribe() racing a close() could return success instead of ErrClosed (RELAY spec §6.2/6.3/6.6). Both operations now share mu_ with close(). Added a 200-iteration concurrent regression test (tests/test_mock.cpp) that asserts, with no sleep, that any channel a successful subscribe() returns is closed by the time a concurrent close() has joined — deterministic with the fix, and was not with the original code.
• [P2] capabilities document omits protocol/protocol_int, inconsistent with version document and spec section-12.2 intent #31 (P2, spec-conformance) — capabilities_json() omitted protocol/protocol_int, inconsistent with version_json() and the spec §12.2 single-protocol-implementation convention. Added both fields.
• [P2] command_latency_test.cpp's non-CI 10ms max-latency gate is flaky under scheduler noise outside real CI (observed failure) #32 (P2, test) — command_latency_test.cpp's non-CI 10 ms max-latency gate was flaky under scheduler noise on any host without CI set (a sandboxed run observed a real 15 ms outlier). Replaced the CI-env-var-gated thresholds with a single generous threshold (P99 < 500 ms, Max < 2 s) applied uniformly, since CI was never a reliable proxy for "noisy scheduler."
• [P2] RELAY spec version pin (1.10) is one minor behind current spec (1.11) #33 (P2, doc) — kRelaySpecVersion was pinned to RELAY spec v1.10; current spec is v1.11. Bumped the constant and the corresponding test/README assertions. No behavioral changes needed (cpp-RCP already ships a CLI target ahead of the v1.11 §17.7 waiver removal).
• [P2] README documents only 2 of ~38 public headers, omitting Adapt()/relay integration and all bridge/control-plane modules #34 (P2, doc) — README's Headers table listed only 2 of ~43 public headers, omitting adapt.hpp (the RELAY §10.3 entry point) and all safety/bridge/control-plane modules. Expanded to a full, concern-grouped index (Core/RELAY integration, Protocol bridges, RCP control-plane concerns, Transports) matching the spec §13.7.2 module-name registry categories.

Left open (no code change here)

• Feature parity: port remaining go-RCP tooling packages (iso21434, certgap, formal, codegen) #23 — "Feature parity: port remaining go-RCP tooling packages (iso21434/certgap/formal/codegen)". This is explicitly framed by its own author as a decision-needed architectural question (port as C++ library modules vs. declare intentionally out of scope in favor of the external cpp-FuSa tool), not a concrete bug or spec-conformance gap. Left open with a comment explaining it needs a human product/architecture decision (and has a companion issue on go-RCP) rather than a guessed-at implementation.

Version

kVersion / PROJECT_VERSION bumped 1.1.0 → 1.2.0 (MINOR — #28 adds a new spec-conformance capability; the rest are bug/doc fixes).

Test plan

• cmake -B build -DCMAKE_BUILD_TYPE=Release -DRELAY_BUILD_CLI=ON -G Ninja && cmake --build build --parallel — clean build
• ctest --test-dir build --output-on-failure -j1 — 41/41 suites pass (including the new concurrency regression test and the previously-flaky latency test)
• relay conform --strict build/cpp-rcp (built from SoundMatt/RELAY main) — PASS on all three §12 schemas
• Manual CLI smoke test of the new send --zone/--type/--payload form (text and JSON) and its error paths (missing flags, unknown type, unknown zone, bad hex)