feat(cluster): RFC 010 c7a — membership events + view at the manager

node_up/node_down are derived facts of the manager's own register/remove
events, so the membership state lives in the manager (no cross-actor race
between 'connection exists' and 'node is up'); src/cluster/membership.rs is
the consumer surface: NodeEvent/NodeInfo, subscribe(), view(). The conn
table stays private — no consumer touches it (roadmap-binding).

Ratified semantics: subscribe() is snapshot-then-stream — one NodeUp per
live peer is queued before the subscription joins the list, exact because
gen_server handlers are serialized. Dropped subscribers are pruned on the
next emit (closed channel), no monitor needed.

One-viable call, flagged: NodeId is memoized per (name, incarnation) — a
compact local alias for the wire identity, per pg.rs's framing. A reconnect
blip at the same incarnation keeps its id; a restart (new incarnation) gets
a fresh one, so a ghost and its successor are always distinguishable.
Allocation starts at 1; NodeId(0) stays pg::DEFAULT_NODE_ID (self).

Call::Register now carries the whole handshake Peer (the path already has
it; node_up needs incarnation + meta).

tests/cluster_membership.rs 4/0 stable over 5 runs (live up/down over
localhost TCP with commanded and EOF teardown; late-subscriber snapshot +
view agreement; restart-vs-blip id identity; dead-subscriber pruning). All
cluster suites regression-clean; clippy --lib green both configs; fmt
clean; default build compiles.

src/cluster.rs

@@ -13,6 +13,7 @@ pub mod connect;
 pub mod envelope;
 pub mod handshake;
 pub mod manager;
+pub mod membership;
 pub mod transport;
 
 use std::time::Duration;
@@ -25,6 +26,7 @@ use crate::supervisor::{ChildSpec, OneForOne, Restart};
 pub use conn::{spawn_established, ConnHandle};
 pub use connect::{dial, spawn_acceptor, AcceptorHandle};
 pub use manager::{Manager, MANAGER};
+pub use membership::{subscribe, view, MembershipEvents, NodeEvent, NodeInfo};
 
 /// c6d — the derived build hash for [`handshake::LocalNode::build_hash`]:
 /// two builds may mesh only when this matches, and it is a pure function of