feat(metaserver): publish authenticated game presence

[zoeyrose]

Summary

• add the disabled-by-default Game Protocol 1 publisher using the released protocol v1.3.0 canonical body and HTTP Message Signature contract
• bind publication to the persistent P-256 leaf identity and an owner-only, append-only, fsync-before-send replay sequence ledger
• serialize startup, visible changes, retry, replay recovery, and jittered heartbeats under persistent and process-local request ceilings
• validate explicit DNS-only endpoints, bound every HTTP/state surface, discard the unused rendezvous credential, and keep observations fixed-cardinality and secret-free
• document the architecture, backup/restore behavior, security boundary, dependency policy, and provenance

Validation

• tools/validate.sh
  • formatting, vet, staticcheck
  • unit and full race suites
  • fuzz smoke and kernel benchmarks
  • govulncheck: no vulnerabilities found
  • dependency/license/notices/SBOM checks
  • reproducible Linux, Windows, and source packages
• focused publisher sequence-parser fuzz seed
• git diff --check

The live production canary/rollback gate is intentionally deferred to the coordinated metaserver cutover and server operations work; this change does not contact or mutate Cloudflare. A companion atrinik/atrinik inventory commit is staged for publication after this dependency graph lands on server main.

Refs #68

[github-actions]

🎉 This PR is included in version 1.1.0 🎉

The release is available on:

• v1.1.0
• GitHub release

Your semantic-release bot 📦🚀