tests: deterministic-runtime coverage for the window protocol and tip semantics

[bagelface]

Consumer context: gas-killer/roadmap#18. These tests are the acceptance gates for the concurrency work, and two of them fail against today's code — which is the point.

Why this is its own issue

The deterministic runtime (commonware_runtime::deterministic) is already used in node/src/task_book.rs, node/src/reporter.rs, and router/src/reporter.rs tests, so reproducible interleavings are available. But router/src/sequencer.rs has no tests that exercise run/drive_height at all — it only tests stamp_dispatch_time and the assignment map. That gap is what let the non-contiguous-tip defect (#188) sit unnoticed, because the defect is invisible unless you can drive the loop with a mock CertIndex and a mock network.

So the first deliverable is the harness, not a test.

Harness

A recording mock NetworkSender / NetworkReceiver for the directive channel, with per-peer drop and reorder controls. commonware_p2p::simulated may be sufficient; if not, a minimal in-crate mock is fine. It needs to support:

• capturing every encoded send with its recipient set, for golden-bytes assertions
• dropping sends to peer k with probability p, or dropping the first n sends per height
• delivering a batch of sends in an arbitrary permutation

Plus a mock CertIndex whose get_tip() and contiguous_tip() can be driven independently — that separation is exactly what the tip tests need.

Tests

node/src/task_book.rs (gates #192):

• out_of_order_window_does_not_skip_live_heights — park waiters at 1..8, deliver Announce{5} then Announce{1}; waiter 1 must resolve to Announce, not Skip. Fails today.
• window_snapshot_skips_only_omitted_heights — {base:1, entries:[T1, _, T3]} → 1 Announce, 2 Skip, 3 Announce, 4 parked
• older_window_seq_does_not_regress — apply seq 2 then seq 1; seq 1 ignored
• explicit_skip_still_overrides_announce — regression for the existing latch
• directive_below_window_base_resolves_skip
• And the whole existing suite must pass unmodified — that is the V1-equivalence proof

node/src/reporter.rs (gates #189):

• tip_mirror_tracks_contiguous_tip_not_max_certified — report Certified(5) with no lower certificates → tip_handle == 0; then Activity::Tip(1) → 1. Fails today.

router/src/reporter.rs (gates #188):

• contiguous_tip_stops_at_first_gap — certify 0, 1, 3 → contiguous_tip() == 2 while get_tip() == 4

router/src/sequencer.rs (new coverage, gates #193):

• never_assigns_beyond_contiguous_tip_plus_window — mock reporting contiguous tip 10, certified 17 → does not assign 18. Fails today.
• window_stays_contiguous_and_bounded — no gaps, len <= W
• superseded_requires_f_plus_one_reports — at n=4, one node's inflated tip must not abandon a live height
• dispatch_time_retains_all_in_flight_heights — replaces the existing test, which asserts the opposite invariant (sequencer: stamp_dispatch_time evicts the timestamps of live lower heights #190)
• w_equals_one_emits_legacy_directive_bytes — golden bytes
• shutdown_drains_inflight_before_returning — next_task() == None must not abandon W heights

Acceptance

• Harness landed and usable from both the node and router test modules
• The three "fails today" tests are written first, confirmed red, then made green by their respective fixes
• Existing test suites pass unmodified
• Runs in CI at a fixed seed set; no flakes over 100 consecutive runs