core: extract Wiremap from Engine

[fosskar]

Second refactor from the architecture review, stacked on #62 (base retargets to main once that merges).

Every wire-key ↔ local-path translation lived as 12 private Engine methods woven through three Engine fields (adapters, excludes, resolver) — and with them the freeze verdicts that keep a skipped key from reading as a mesh-wide deletion: excluded keys (#14), the dropped-agent guard, and the failed-mapping tombstone withhold (#49). None of it was directly testable; the only coverage ran through two-node integration tests.

• New wiremap.rs owns the adapters, the per-agent excludes, and the path-map Resolver behind one interface: key_of/local_dest_of/localize/canonical_plaintext for translation, excluded/frozen/tombstone_withheld for freeze verdicts, plus identify/session_files/roots pass-throughs — Engine never touches adapters directly.
• key_of records mapping failures itself and returns an explicit KeyLookup outcome. A skipped lookup carries the anyhow::Error only for its first log announcement; begin_pass scopes the Failure and collision semantics #49 tombstone freeze to one tick.
• Wire-key decoding is centralized in one private key_parts helper, preventing translation drift and repeated adapter scans.
• Six new inline unit tests cover the invariants without iroh: key/destination round-trip, per-agent exclude scoping, dropped-agent freeze, mapping-failure tombstone withholding with log-once, merge-policy lookup, and root containment.
• Engine sheds ~200 lines; cleanup/search re-point to wiremap::session_files; AGENTS.md gains the Wiremap term.
• In-process direct-path tests now use LAN-only endpoints and wait for direct addresses before syncing, keeping public n0 discovery and relays out of tests that only exercise explicit local peers.

No version bump: pure refactor and test isolation, no user-visible behavior change.

Verified:

• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace -- --test-threads=1 — 230 passed
• both formerly flaky ssync-net tests passed 10/10 repeated iterations
• nix fmt