fix(cli): M6 CP6 — single-UDP-transport startup guard

[ryanmurf]

M6 CP6 — single-UDP-transport startup guard

FINDING. rustisk wires the SIP transport through two passes that DISAGREE if more than one runs:
the channel driver keeps the LAST transport it is handed (set_transport is last-wins) while the
global event handler keeps the FIRST (set_global_event_handler is a first-wins OnceLock). With
two configured UDP transports the startup loop runs twice, so inbound would be handled on the first
socket while outbound is sent on the second — a silent split-brain / race.

FIX. A startup guard, single_udp_transport(&[SocketAddr]) -> Result<SocketAddr, String>,
asserts exactly ONE UDP bind after de-dup and fails startup fast (Err propagated from
startup_sequence) rather than binding two. The transport loop now iterates over the single guarded
bind. Two identical binds (deduped to one) still pass; two DISTINCT binds are rejected with a message
explaining the single-transport rule.

PROOF + RED. Unit tests: accepts exactly one (returns the bind unchanged); rejects two distinct
(the guard's whole purpose); rejects empty. RED — make the guard return Ok(many[0]) for >1:

thread 'tests::single_udp_transport_rejects_two' panicked:
two distinct UDP transports must be rejected: 0.0.0.0:5060

(the guard silently accepts two → the reject-two assertion fails).

Ordering note. CP6 is independent of CP5 (it only touches crates/rustisk-cli/src/main.rs),
landed ahead of CP5 to bank its value; CP5 branches cleanly on top.

GATES. cargo test --workspace --exclude pjsip-shim green; cargo clippy --workspace --exclude pjsip-shim -- -D warnings clean. Rust 1.97.0.

[ryanmurf]

Codex review disposition (gpt-5.5, xhigh)

Codex verified placement (guard after de-dup, before any SipStack::new/set_transport/set_global_event_handler), cardinality, loop semantics (from_ref preserves the item type + single iteration), fail-fast appropriateness, and UDP+TLS still accepted (only udp binds enter the guarded set). One finding:

• P2 (test) — FIXED (4ba563b): the tests pinned the helper but not the startup wiring / dedup ordering (removing the production call, or moving dedup after the guard, left them green). Extracted udp_transport_binds (collect + de-dup) and resolve_single_udp_bind (binds + guard), and routed startup through resolve_single_udp_bind — the single path startup uses. New config-level tests exercise that exact entry point: two DISTINCT udp transports rejected, two IDENTICAL dedup-to-one accepted (pinning dedup-before-guard), no-config → default. These fail RED if the guard is removed from the startup path or dedup is reordered.

CI green; workspace test + clippy green locally.