relay-hops: prevent namespace loops across relay cycles

[mondain]

Summary

• implement draft-lcurley-moq-relay-hops namespace path ingestion and forwarding
• generate a stable process-lifetime relay Hop ID and stable per-source-session stand-in IDs for legacy peers
• advertise relay-hops support on all server transports and upstream sessions
• drop returning advertisements, reject malformed paths, and honor EXCLUDE_HOP
• add unit coverage plus a three-relay cycle integration test
• add the local draft, implementation plan, configuration reference, and deployment/configuration guide

Why

Namespace advertisements can circulate indefinitely when connected relays form a cycle. The negotiated hop path lets each relay recognize its own returning advertisement without requiring centrally assigned identifiers or a YAML topology map.

Deployment impact

Relay-hops negotiation is automatic and session-local; there is no new YAML toggle. Non-negotiated peers retain legacy behavior. Any graph segment containing a legacy relay must remain acyclic because that relay cannot preserve the path.

Each service still supports a single upstream. Multi-upstream path selection and failover remain deferred.

Dependency

• Requires relay-hops: add hop path wire and negotiation support moxygen#329
• This branch pins the final commit from that dependency branch.

Validation

• 15 relay-policy unit cases across single-thread, multi-thread, and local-forwarder modes
• relay_chain integration test
• relay_hops_cycle integration test
• 31 focused moxygen framing and negotiation tests
• both complete deployment-guide YAML examples pass validate-config --strict_config
• ./scripts/format.sh --check
• git diff --check origin/main..HEAD

---

This change is