feat(ws): make transport payloads bytes-native

[pathscale]

Outcome

Moves endpoint-libs to 3.0 with immutable byte-backed WireMessage payloads. Framed local transports retain their receive allocation, and tungstenite WSS transfers text, binary, ping, pong, and close-reason buffers without cloning. The on-wire formats are unchanged.

API migration

• Text now carries Utf8Bytes.
• Binary and control frames now carry bytes::Bytes.
• Owned String and Vec inputs transfer their allocations.
• Constructors and the 3.0 migration guide keep call-site changes mechanical.
• Removes the deprecated, unused database feature and PostgreSQL helper module; applications should own their database layer directly.
• Removes the tracked library Cargo.lock so consumers resolve current compatible dependencies.

CI hardening

• Pins every third-party Action to an immutable commit.
• Replaces deprecated actions-rs/toolchain with dtolnay/rust-toolchain.
• Removes unnecessary write permissions.
• Runs Rust CI against the actual master branch.
• Replaces the combinatorial cargo-all-features power set with explicit minimal/default/agent-control/ws-client/ws/full/all-features boundaries.
• Generates a temporary lockfile for security audit only.
• Updates h2 past RUSTSEC-2026-0258.
• Removes unused rust_decimal/rkyv and PostgreSQL dependency stacks.

Verification

• Endpoint linear feature matrix passed; all-features: 106 unit and 5 transport integration tests.
• Strict Clippy linear feature matrix passed with warnings denied for all targets.
• cargo package verification passed.
• cargo audit reports zero vulnerabilities; two allowed upstream unmaintained-macro warnings remain.
• Allocation-identity tests cover owned inputs, framed receive, and both WSS directions.
• AgencyProxy: strict workspace Clippy plus 20 tests passed against endpoint-libs 3.
• ps-observability: strict workspace Clippy plus 160 tests, including the real socket host integration, passed.
• tauri-runtime-blitz: strict workspace Clippy plus 36 tests passed.
• AgencyZero: Bun lint/control audit/typecheck/build, strict Rust Clippy, and full Rust workspace tests passed, including 304 az-gui tests.
• Live AgencyZero debug app launched with one resolved endpoint-libs 3.0.0; Settings navigation, language selector interaction, semantic inspection, node capture, and graceful shutdown worked.
• 1,000 full-tree inspection round trips completed in 5.7 seconds with exactly stable AZ and AgencyProxy RSS.
• Final AZ graph contains no PostgreSQL stack. ChaCha20 remains only through the actively used ps-boa RNG path.