S2 phase 9: inclusion bootstrap wiring

[Assar63]

Drive phases 5-7 inside the inclusion flow.

• When an inclusion NIF advertises CC 0x9F, run KEX -> public key/DSK -> network-key install before emitting "complete"
• Track DSK-pending state so concurrent inclusions stay disambiguated (document the single-session assumption)

Part of the Security S2 (CC 0x9F) epic — see #27 for the full design, crypto choice, wire surface, key classes, and definition of done. S2 is the largest epic in the daemon; it builds on the S0 work (#26) but adds multi-class keys, ECDH inclusion, and the SPAN nonce protocol.