fix: clear the review residuals on main before the 0.28.0 cut

[bahdotsh]

Summary

Clears every residual that a review of a PR merged since v0.27.0 left on main, before the 0.28.0 cut. Each residual was a claim someone verified by hand once and nothing in CI verified afterwards: two release-workflow steps no run has exercised, sentences that described a different order or parser than the code, and branches whose tests passed with the branch deleted.

Twelve commits, one per residual family, each independent of the others:

Commit	Came from	What changes
ci(release): tell a failing npm view from a staging publish	#464	The provenance verify poll keeps npm's stderr. Nothing, a warning or an E404 is staging. Any other npm error is printed, and the timeout names it instead of blaming the registry.
ci: key the iOS Rust caches on the podspec	#475	cargo does not rebuild Rust crates when IPHONEOS_DEPLOYMENT_TARGET changes. Both iOS caches put the podspec's hash in shared-key. It cannot go in key, which rust-cache ignores when shared-key is set.
fix(bindings): check the deployment target inside package_xcframework	#474	The gate moved into the pod's packaging function, which now takes the target. The Swift package's packager still relies on the CI job's own gate step, and the docs say so. The test drives the function with stand-ins for otool, lipo and xcodebuild, replacing line-order greps that missed 4 of 6 breaking edits.
fix(bindings): say where the Kotlin timestamp parser parts from Instant	#475	Four sentences claimed parity with Instant. The parser matches Instant for every timestamp a relay sends, and refuses hour 24, an empty fraction, lowercase t/z and a leap second, which Instant accepted. \d became [0-9], pinned by a Rust guard.
test(bindings): pin a mesh wake whose service does not start	#475	Robolectric's startService never returns null, so the null branch goes through an internal seam and is now tested.
ci(bindings): lint the Android library for calls newer than minSdk	#475	Lint's NewApi check runs alone on the library and fails the build. Generated bindings are excluded: their one newer call sits behind a Class.forName.
test(leaf): pin the pointer guard's tokenizer	#476	Four tokenizer behaviours get pins. The module doc names the three routes a one-file scan cannot follow.
fix(protocol): tell an unreadable sealed record from one that does not open	#468	A read error was reported as "does not open under this store key" and counted towards WrongStoreKey. The probe skips an unreadable record, so a readable one can still prove the key, and reports the read failure, naming the record, only when nothing opens. The listing warns with the real cause and still skips the record. The warn-once memo forgets a path when it is written or removed.
test(protocol): open the file stores over a relative root	#468	A new test binary pins flush_target at its call site. Before this, bypassing it passed every test.
fix(protocol): a sealed record that opens outranks a pairing-id mismatch	#470	A mismatch now asks the records, and only one that opens under this MLS store's record key admits the state root. Two tests pin branches that survived mutation. Three sentences said the MLS store is written first; the state store is.
fix(protocol,mls): check key-type isolation before the state suite deletes	#466	The FFI-exposed protocol-state suite deleted what it listed before any check ran, so a merging backend lost real records to it. It now checks isolation first and stops on a failure. Both suites gain a probe type related by suffix. Check count and names are unchanged.
fix(bindings): two orderings in the peer-stream managers	#465	iOS stop() clears the session before ending links. Android resets the redial delay on a new connection after a disconnect. Both are pinned by a source guard.

Already closed on main, so not in this PR: the second podspec reader and the gate's error text from #474 (fixed by #475), the rustix comment from #468, and the React Native guide's appId gap (#462). The Android library's missing INTERNET permission is by design and documented in bindings/kotlin/README.md.

Verification

• Every behavioural fix was mutation-checked: each mutant of the fix fails a test. 31 mutants across the gate, the Kotlin parser, the wake seam, the tokenizer, the sealed store, the pairing and both suites; all caught.
• npm verify step: extracted from the YAML and run under a fake npm for four scenarios (staging then live, persistent DNS failure, a transient failure then staging, never visible). Each ends with the right annotation.
• Android lint: green on the library. A planted java.time call fails it, and without lint.xml the only hit is the generated Cleaner.
• Android: 551 unit tests pass in a clean copy. The other 10 are the vector-file lookup that works only inside the repository.
• iOS: the CI bridge typecheck step, run verbatim, is clean, and a planted type error fails it.
• A fresh-context reviewer read the whole diff before the push. It found two blocking issues, both fixed: the cache key first went in key, which rust-cache ignores, and the docs claimed the gate covered the Swift package's packager. Its five non-blocking findings were fixed too.
• Workspace: 3,033 unit tests pass, plus the checklist below.

Not in this PR

The release cut itself, an rc tag, and the two-phone smoke test. The public API of the native packages. The ARM32 UniFFI checksum defect. Dependabot.

Type of change

• fix: bug fix
• test / ci

Checklist

• Commits follow Conventional Commits
• cargo fmt --all -- --check
• cargo clippy --workspace --locked -- -D warnings
• cargo test --workspace --lib
• RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps
• Leaf no_std clippy on all four embedded targets
• CHANGELOG updated under [Unreleased]