v0.7.1: fix 8 issues from hands-on evaluation

[hwbehrens]

Description

Fixes 8 issues identified during v0.7 hands-on binary testing (evaluations/hands-on-evaluation-2026-02-18-v0.7.md).

Changes

1. Client-side IPC size check — rejects >64KB commands before connecting to the daemon socket, preventing broken pipe errors
2. config get unset key — prints <key>: not set to stderr (exit code 1 preserved, stdout stays empty for scriptability)
3. Reject port 0 — config set port 0 now fails with a clear error (QUIC requires a non-zero port)
4. --verbose IPC logging — adds tracing::debug! calls to the IPC client path (socket path, command size, event filtering)
5. doctor --fix config reset — can now backup and reset corrupt config.yaml (matches existing known_peers.json pattern)
6. Peers empty message — shortened from "No peers found." to "No peers."
7. request help text — documents {"message":"<TEXT>"} payload wrapping
8. notify help text — documents {"data":"<TEXT>"} / {"data":<JSON>} payload wrapping

Infrastructure

• MAX_IPC_LINE_LENGTH promoted to pub const in ipc::protocol (single source of truth, shared by server and client)
• README Internal Constants table updated for new constant location
• Version bumped to 0.7.1

Tests added

• Unit: port 0 rejection, port boundary values, key display name mapping, IPC oversized command rejection
• Black-box CLI: config set port 0 exit code + stderr, config get unset key stderr message
• Black-box doctor: corrupt config check-mode (fixable flag + hint), fix-mode (backup + reset + report)

Contribution Checklist

Security & Hardening

• mTLS peer pinning and identity binding remain correct
• Handshake / hello-first gating preserved
• Replay protection unchanged or improved
• Resource/DoS controls (max message size, connection caps, IPC bounds) preserved
• No secrets or key material exposed in logs

Test Quality & Coverage

• Tests added/updated for every behavior change
• Invariant-driven assertions (hello gating, pinning, initiator rule, replay dedup)
• Spec compliance tests updated if schemas/wire behavior changed
• No flaky or timing-dependent tests introduced

Performance & Efficiency

• No unnecessary allocations/copies in hot paths
• No blocking I/O on the async reactor
• Bounded concurrency and backpressure preserved

Maintainability & Code Quality

• Follows existing code conventions and module boundaries
• Source files remain under 500 lines
• No new dependencies without justification

Operational Maturity

• Tracing events include peer identifiers and message IDs
• Config precedence (CLI > config.toml > defaults) preserved if modified
• Daemon startup/shutdown lifecycle remains clean
• If CLI/path/persisted-format behavior changed, linked cli_contract tests and docs/spec/help updates are included

Adversarial Robustness

• Fuzz target added for any new deserialization entrypoint
• Adversarial tests extended for new attack surface
• Protocol violations handled safely (no panics on bad input)

Contribution Hygiene

• make verify passes (fmt + clippy + tests)
• Spec/docs updated when behavior or schemas change
• PR is focused — no drive-by refactors

Interop & Spec Drift Control

• Wire compatibility preserved (one-message-per-stream, FIN delimiting, max size)
• Schema changes reflected in spec/MESSAGE_TYPES.md and spec/WIRE_FORMAT.md

Self-Assessment Score

Score: 99/100