fix: report local node-check failures honestly

[Divaaaan]

Summary

• make the on-connect multi-destination probe reserve an owned loopback port block, authenticate readiness, observe early process exit, and retain bounded scrubbed engine logs
• make the desktop distinguish direct TCP measurement states, expose retry, and prevent stale or cross-profile RTT data from looking current
• synchronize version metadata and release notes for the 0.6.1 candidate

Verification

• gofmt -l ., go build ./..., go vet ./..., and staticcheck ./...
• focused core race tests and the full Go race suite excluding seven pre-existing Windows named-pipe tests that require the elevated hosted runner
• real bundled sing-box config validation
• frontend typecheck, lint, production build, and 823 tests
• Rust fmt, clippy, 196 tests plus one intentional VM-only ignore, including the real sidecar E2E
• 94 Node workflow/release tests plus one expected filesystem skip
• unsigned Windows NSIS bundle build

Acceptance boundary

The exact trigger on the affected desktop was not causally preserved by the old build. This fixes the reproduced failure classes and makes remaining local failures observable. Native installation, service, ordinary-user UI, and real-tunnel acceptance must be performed on the exact signed candidate before promotion. This PR does not publish or move the stable channel.