feat(cluster): RFC 010 c2 — owned wire envelope

Frame enum per the RFC inventory; hand-rolled encode/decode with u32 LE
length prefix + u8 tag; strings u16-prefixed, payload blobs u32-prefixed;
MAX_FRAME_LEN cap (control plane never carries bulk, §5). Streaming decode:
Ok(None) = need more bytes, every Err = corruption. postcard confined to
encode_payload/decode_payload — the single codec seam (§2); postcard gains
the alloc feature for to_allocvec (still no_std-aligned, no default
features). DownReason/RejectReason travel as single tag bytes; Down tag 5
is reserved for c11's Disconnected.

Tests: per-frame roundtrip, back-to-back frames, golden heartbeat bytes,
zero-length payload, every-prefix incomplete, unknown frame/enum tags,
length prefix lying long (with and without bytes present) and short,
truncation mid-string, adversarial lengths (u32::MAX, cap+1, zero), UTF-8
corruption, payload seam roundtrip through a real Send frame.

Cargo.toml

@@ -51,13 +51,16 @@ cc = "1"
 libc = "0.2"
 # RFC 010 §2 — only compiled under `--features cluster`.
 serde = { version = "1", default-features = false, optional = true }
-postcard = { version = "1", default-features = false, optional = true }
+# `alloc` (not `std`): the seam serializes to Vec; postcard stays no_std-aligned.
+postcard = { version = "1", default-features = false, features = ["alloc"], optional = true }
 
 [target.'cfg(loom)'.dependencies]
 loom = "0.7"
 
 [dev-dependencies]
 libc = "0.2"
+# derive + std for cluster envelope tests only; the lib itself never needs them
+serde = { version = "1", features = ["derive"] }
 tokio = { version = "1", features = ["rt", "rt-multi-thread", "macros", "sync", "time"] }
 
 [profile.dev]