fix(kerykeion): bound the outbound pending queue

[forkwright]

Summary

#229's last unbounded-growth clause: OutboundQueue::pending had no bound.

max_inflight bounds only what awaits an ACK, which is easy to read as bounding the queue. The queue
behind it was unbounded, so anything enqueuing faster than the radio drains — a chatty caller, or a
store-and-forward backlog arriving at once — grew memory without limit.

The refused message is handed back

enqueue returns Result<(), PendingMessage>. Dropping it inside the queue would have been simpler
and wrong: the two callers want different things, and neither can act on a message the queue has
already discarded.

send reports the refusal through the existing QueueFull error. The caller asked to send; a
queue that silently swallowed the message would look identical to one that accepted it.

The store-and-forward drain is the case that needed care. drain_for removes everything it
returns, so enqueuing until the queue refused would have destroyed the remainder — trading an
unbounded queue for silent message loss, which is a worse bug than the one being fixed. It now takes
only what fits and returns the rest to store-and-forward, so a saturated outbound queue delays
delivery rather than losing it. The mid-drain guard stays as a belt-and-braces break with a warning.

Tests

The bound refuses past its limit; the refused message comes back with its own packet id, which is what
makes the two caller behaviours possible; and a queue within its bound still accepts — the
anti-vacuity partner, without which both cases would pass against a queue that refuses everything.

The fourteen existing test call sites go through a helper that asserts acceptance rather than
discarding the new Result. let _ = at each site would have silenced exactly the regression the
anti-vacuity test exists to catch.

Scope

This closes the unbounded-growth clauses of #229. One clause remains: crypto.rs swallowing per-key
initialization errors and accepting any protobuf-decodable trial plaintext as channel attribution.
That one is a design question — trial decryption without an authentication tag cannot do better than
"it parsed" — and deserves its own change rather than an incidental patch.

Refs #229