Export every reachable session state for migration

[germ-mark]

After the cutover nothing drives a Rust session, so a migration export that refuses a session loses it. This PR makes migration_export total. Every reachable deployed state exports, the native engine can mint it, and only corrupt data fails (ArchiveInvalid). BINDING_CONTRACT_VERSION bumps 35 → 36.

• Keys: each group's signing keys are keyed by what its leaf presents, found by a derive-match. There are reservation keys for groups not yet created, catch-up entries for lagging leaves, and every rotation candidate in both classical sets. A pre-A.3 acceptor's send-PQ is empty, since A.3 founding mints its own key. A leaf whose key survives nowhere is exported as no-custody instead of refused.
• Own offers: a peer can fold any outstanding own offer. So a window (capped at 102,400) carries them with their leaf secrets, minted as a separate on-demand blob. Offers the carried keys don't cover are omitted; a peer folding one wedges that session (accepted).
• Deployed state: parked, wedged and mis-signed PQ rounds are carried as they are, for the native engine to heal.
• Mapper: SessionMigrator.mint returns the archive plus the optional window. mintArchive is removed.
• Also:
  • .misroutedFrame now has disposition .discardFrame, which shifts app handling and analytics;
  • every group's suite is checked before any crypto;
  • a correction to the 0.17.0 changelog.

Dependencies

• mls-rs is pinned to germ-integration 1ce5ae3, which adds the pending-signer, own-proposal and pending-placement exports (Export pending-update signers and own proposals for swift migration mls-rs#14).
• twomlspq-swift is pinned to unreleased main (902fead) for the deployed-state inputs and the empty pre-A.3 send-PQ shape. It must move to its release before merge.

Tests

• Rust: cargo test -p two-mls-pq --features cryptokit passes 370, also with cryptokit,awslc. A seeded totality walk exports both sides at every step across the card, anchor, late-A.3 and born-dedicated modes, including mid-prepare.
• Swift: 98 migrate and 19 other tests pass. They include cross-engine mint and restore for each carried state, a migrated pre-A.3 acceptor answering A.3 natively, the v0.15.0 and v0.16.0 row fixtures, and a heal proof for a stuck Rust A.5 rekey.
• Clippy ×3, fmt, taplo and swift-format are clean.

Note, not introduced here: the "MSRV (1.85)" CI job builds with stable, because rust/rust-toolchain.toml overrides it. The real minimum is at least 1.88, since mls-rs-codec-derive needs darling 0.23.

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 4738fe3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@germ-network/two-mls-pq	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR