Adds the wire surface and the cert-loading constructors that
omni-sync's QuicTransport needs for sealed-day replication to a
peer Garage node.
Protocol additions (rkyv discriminants are positional — appended
at the end, never inserted):
- `SyncMessage::SealedFile { peer_name, payload }`: sealed `.h5`
delivery from `omni-sync` clients (omni-cortex daemons
replicating sealed-day Working / Episodic / Semantic tier
files to a peer).
- `SyncMessage::SealedFileAck { peer_name, bytes, blake3_hex }`:
receiver-computed BLAKE3 acknowledgement so the sender can
verify the bytes landed intact.
QuicConfig constructors for production mTLS:
- `client_with_pem(client_cert, client_key, server_ca)` — loads
the operator's mTLS leaf identity + the CA whose-issued server
certs the client trusts. Builds a real rustls `ClientConfig`
via `with_client_auth_cert`. Server config field gets a
placeholder (never consumed by `quic_connect`).
- `server_with_pem(server_cert, server_key, client_ca)` — mirror
for the receive side. Real rustls `ServerConfig` with
`WebPkiClientVerifier::builder(roots).build()` +
`with_client_cert_verifier` (mutual auth: clients without a
CA-issued cert fail the handshake) + `with_single_cert`.
Validated by `omni-sync`'s D193 production-mTLS round-trip test:
rcgen-generates CA + matching server cert + matching client
cert, writes PEMs to a tempdir, spawns a `QuicServer` with
`server_with_pem`, drives a real `QuicTransport` production-mode
client through `SealedFile` → `SealedFileAck` with mutual cert
verification.
Also includes a `rustls-pemfile = "2.2"` dep + ambient
`cargo fmt` line-collapsing in `framed.rs` and `peer.rs` from
when the workspace was reformatted.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
