fix(lint): burn down the kanon-lint debt baseline and delete it

[forkwright]

What was wrong

kanon lint carried 18 pre-existing violations against hamma main (11 in .kanon-lint-baseline.toml, 7 unbaselined), blocking kanon gate --stamp — no PR could earn the Gate-Passed trailer required by gate-attestation. The baseline entries carry remove_after = "2026-08-13"; an expired non-empty baseline makes kanon lint return an error and stop linting entirely, which also blocks the gate.

What changed

Resolves every entry in .kanon-lint-baseline.toml plus the 7 unbaselined violations, so the baseline can be deleted rather than extended:

• Crate rename (NAMING/no-owner-prefix):hamma-core → mitos. The old name prefixed the parent fleet repo; mitos (Greek mitos, "loom-thread") keeps the family's weaving vocabulary (hamma "knot", dictyon "net", histos "loom"). Every hamma_core:: / hamma-core path across dictyon, docs, and CI comments moves with it; CHANGELOG.md is untouched (historical record).
• File-too-long (RUST/file-too-long):wire.rs (1288 lines) splits into wire/{mod,support,tests}.rs; config.rs and types.rs each split into <name>/{mod,tests}.rs, moving their test modules into sibling files — the same pattern control.rs and noise.rs already use in this crate. Cross-module helpers land as pub(super) fns called via support::.
• RUST/indexing-slicing:parse_server_key_response now uses response.get(body_start..) instead of &response[body_start..].
• RUST/no-silent-result-swallow:hex_encode no longer routes through fmt::Write (whose Result on a String can never actually be Err, which is what made let _ = a swallow); it writes nibbles through a checked lookup table instead.
• RUST/no-debug-derive-on-public-types (RegisterRequest, MapRequest, Node, PeerChange): each flagged struct's only "secret-shaped" fields are public-key hex (already carrying field-level plain-string-secret ignores) or, for RegisterRequest, the already-redacting AuthInfo::Debug the derive calls into — kanon:ignore with a NOTE recording why, mirroring the existing plain-string-secret convention in this same file.
• COMMENTS/deflection-without-tracking:RegisterRequest::followup's doc reworded off the trigger phrase "Follow-up" (the field names a real protocol continuation URL, not deferred work).
• RUST/primitive-for-domain-id:Hostinfo::backend_log_id is now a BackendLogId newtype (#[serde(transparent)]) instead of a bare String, with every construction site (mitos, dictyon, both test suites) updated.
• RUST/non-exhaustive-enum:PeerRemoval gains #[non_exhaustive]; dictyon's one exhaustive match over it (PeerRemovalIndex::build) gets the required wildcard arm.
• RUST/config-deny-unknown-fields:DnsConfig mirrors Tailscale's wire DNSConfig response type, not a local operator config — denying unknown fields would make dictyon reject a MapResponse the day a conforming server adds a DNS field. kanon:ignore with a NOTE recording the forward-compatibility rationale.
• YAML/missing-concurrency:gate-attestation.yml deliberately carries no concurrency block (the reusable it calls already declares one; a second one under the same key self-cancels, per that file's own WHY comment). Suppressed via .kanon-lint-ignore rather than "fixed" into a regression.
• OIKOS/private-content: the internal kanon.lan forge hostname is redacted to a <kanon-forge-host> placeholder across CONTRIBUTING.md (3 sites); the one occurrence that was purely restating "the forge is unreachable" drops the hostname entirely instead of adding a fourth placeholder.
• WRITING/identity-fluff: drops "sovereign"/"sovereignty" from README.md (thumos's description, the histos hardware-attestation phase heading and its Phase C entry) in favor of concrete descriptions of what those extensions do.

Verification

Not restated with a Gate-Passed trailer on this commit; CI on this PR (fmt, check, clippy, nextest, kanon lint) is the verifier per the current op-pause convention on this repo.

Refs #57