feat: 0-RTT on both sides

[Lavmee]

Adds 0-RTT on both the dialling and the accepting side, so an application that reconnects to a peer it has spoken to before can send application data in the first flight instead of paying a full handshake round trip.

The shape, and why it is not a flag

Upstream models a 0-RTT connection as a distinct Rust type with a smaller method surface: no paths, and alpn()/remote_id() become optional. That collides with this binding's TypeId-tagged handles, with stream.rs's typing, and with the path watchers.

Rather than weaken Connection's contract for everyone — its alpn() KDoc promises "always present" — the surface every handshake state shares moved into a sealed class QuicConnection. Connection keeps what only a completed handshake has (alpn, remoteId, side, paths, rtt); OutgoingZeroRttConnection and IncomingZeroRttConnection add nullable alpn/remoteId. Stream.kt's four openers moved to the supertype, because sending early data is opening a stream.

On the Rust side the shared surface gained no new exports: connection_clone_any probes the three tags in turn and forwards through an AnyConnection enum, so the existing exports accept any handshake state. The strict connection_clone stays for watch.rs's path watchers and the four handshake-completed-only readers.

API

suspend fun Connecting.zeroRtt(): OutgoingZeroRttConnection?   // null: no session ticket
suspend fun Accepting.zeroRtt(): IncomingZeroRttConnection     // infallible upstream
suspend fun OutgoingZeroRttConnection.awaitHandshake(): ZeroRttStatus
suspend fun IncomingZeroRttConnection.awaitHandshake(): Connection

Connecting.zeroRtt() answers null rather than raising when the endpoint holds no ticket, and the attempt stays usable — that is upstream's two-way branch, not a failure. ZeroRttStatus.Rejected carries a working connection: rejection means the early streams are dead and their data must be resent.

Also: EndpointConfig.maxTlsTickets, RecvStream.is0Rtt(), and IrohError.Code.ZeroRttRejected so a refused early stream is distinguishable from an ordinary write failure.

What is proven, and what is not

Acceptance and rejection are both demonstrated over loopback, rejection by restarting the server endpoint under the same SecretKey — upstream's own recipe.

Two things are deliberately not asserted, both measured rather than assumed, and both written into STATUS.md:

• The per-stream ZeroRttRejected code is not pinned by a live refused write. It was tried: 0 of 9 runs on the JVM facade, 10 of 16 on cinterop. noq captures a stream's is_0rtt once, at the open's first poll, and this binding dispatches zeroRtt, openBi and awaitHandshake as three independently spawned tokio tasks — so a driver that already processed the rejection leaves an ordinary stream whose write correctly succeeds. It is pinned instead by Rust unit tests over the four failure mappers, a Kotlin ordinal assertion, and a compile-time assertion that the constant is 15.
• is0Rtt() == true is asserted nowhere: poll_accept samples the handshake state when the stream is accepted rather than when it was created.

Corrections this work forced elsewhere

• maxTlsTickets = 0 does not disable 0-RTT, though the design said it did. rustls rounds it to a per-server budget of 0, but VecDeque::with_capacity(0)'s first push_back overshoots to capacity 4, so the eviction condition never fires and the ticket is kept. Measured, not read: a ticket arrives in two dial attempts, 3/3 runs, on both facades. The claim is retracted in the KDoc, in Rust and in STATUS.md, and a test now pins the real behaviour.
• cargo test ran in no gate. The crate's first #[cfg(test)] module arrived here, and clippy without --all-targets does not even typecheck one — so the substitute pinning above would have been dead weight in CI. cargo test is now in AGENTS.md's gate list and in ci.yml.
• Once's "exactly one caller" invariant now has one documented exception, and AGENTS.md says so alongside connection.rs.

Compatibility

Source-compatible. Not binary-compatible: Stream.kt's four extension functions changed their first parameter type from Connection to QuicConnection, so consumers compiled against an earlier build must recompile.

Verification

240 shared bodies per tested facade (480 across jvmTest and macosArm64Test), 246 on Android, 726 host tests, plus 4 Rust unit tests. All six gates green.