feat(rumble): host-authoritative self-terminating envelopes (0xCA v2)

Rumble was level-triggered, unbounded state on a lossy channel: a non-zero
level meant "buzz until further notice", healed only by the host re-sending
state every 500 ms, and every client guessed when the host had died with its own
magic timeout (SDL 1.5 s, Apple 1.6 s, Android up to 60 s). A lost stop, a
reordered start, or a dead host could drone the motor for seconds.

Make "stuck rumble" inexpressible on the wire. The 0xCA datagram grows a
length-tolerant tail — [u8 seq][u16 ttl_ms] — so it self-terminates: the host
authorizes a level for at most ttl_ms and renews it (~120 ms) while it holds,
letting an abandoned one lapse client-side. seq is a per-pad wrapping reorder
gate (reusing GamepadSnapshot::seq_newer) so a reordered stale start can't
re-light a stopped motor. Decoders read the first 7 bytes as a plain level and
ignore the tail, so no wire-version bump: an old client renders a new host's
levels, and a new client falls back to its prior staleness heuristic against an
old host (ttl = None). All four generation pairings render correctly.

- core: encode_rumble_datagram_v2 / decode_rumble_envelope (datagram.rs); the
  client demux applies the seq gate then forwards (pad, low, high, Option<ttl>);
  next_rumble is unchanged (drops ttl), next_rumble_ttl keeps it; ABI adds
  punktfunk_connection_next_rumble2 + PUNKTFUNK_RUMBLE_NO_TTL, ABI_VERSION 4->5
  (WIRE_VERSION unchanged — the tail is backward-compatible).
- host (punktfunk1.rs): the flat 500 ms refresh becomes a renewal loop that bumps
  seq + stamps a fresh TTL on active pads and drains a short post-stop zero burst,
  then goes quiet. Hatches: PUNKTFUNK_RUMBLE_ENVELOPE=0 (legacy v1 + flat refresh,
  a bisect switch), PUNKTFUNK_RUMBLE_TTL_MS (clamped [150, 5000]).
- renderers honor the TTL as their playback duration/deadline and keep their old
  heuristic only for a legacy (ttl=None) update: pf-client-core (the Deck haptic
  keep-alive is now deadline-bounded so it can't sustain a host-stopped rumble),
  clients/windows (SDL duration), android (JNI packs the lease out-of-band in bit
  48 so any u16 ttl is unambiguous; Kotlin createOneShot(ttl)), apple
  (RumbleRenderer.envelopeDeadline + nextRumble2; sessionStaleSeconds demoted to
  the legacy fallback).
- tests: codec round-trip + tail tolerance + seq-gate reorder (Rust); the probe
  asserts the v2 tail arrived under PUNKTFUNK_TEST_FEEDBACK; the Apple loopback
  asserts ttlMs round-trips end to end; RumbleTuning lease-decision cases.

The host-side idle-timeout from the previous commit is defense in depth on the
game side; this is the guarantee on the client side. Design:
punktfunk-planning/design/rumble-envelope-plan.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-core/src/quic/tests.rs

@@ -949,6 +949,79 @@ fn rumble_datagram_roundtrip() {
     assert!(decode_rumble_datagram(&d[..6]).is_none());
 }
 
+#[test]
+fn rumble_envelope_roundtrip_and_legacy_tolerance() {
+    // v2 envelope round-trips seq + ttl.
+    let d = encode_rumble_datagram_v2(2, 0x4000, 0x8000, 7, 400);
+    assert_eq!(d[0], RUMBLE_MAGIC);
+    assert_eq!(d.len(), RUMBLE_V2_LEN);
+    assert_eq!(
+        decode_rumble_envelope(&d),
+        Some(RumbleUpdate {
+            pad: 2,
+            low: 0x4000,
+            high: 0x8000,
+            envelope: Some(RumbleEnvelope {
+                seq: 7,
+                ttl_ms: 400
+            }),
+        })
+    );
+    // The legacy level decoder reads a v2 datagram as a plain level — the tail is ignored, so an
+    // old client running against a new host still renders the right amplitudes.
+    assert_eq!(decode_rumble_datagram(&d), Some((2, 0x4000, 0x8000)));
+
+    // A legacy 7-byte datagram (old host) decodes as a level with no envelope — a new client then
+    // applies its own staleness policy.
+    let v1 = encode_rumble_datagram(3, 0x1111, 0x2222);
+    assert_eq!(
+        decode_rumble_envelope(&v1),
+        Some(RumbleUpdate {
+            pad: 3,
+            low: 0x1111,
+            high: 0x2222,
+            envelope: None,
+        })
+    );
+
+    // A torn/short tail (8 or 9 bytes) is not a valid envelope — degrade to a level, never panic
+    // or drop. (The host never emits these; a truncating middlebox might.)
+    assert_eq!(
+        decode_rumble_envelope(&d[..8]).map(|u| u.envelope),
+        Some(None)
+    );
+    assert_eq!(
+        decode_rumble_envelope(&d[..9]).map(|u| u.envelope),
+        Some(None)
+    );
+
+    // Bad tag / too short → None on both decoders.
+    assert!(decode_rumble_envelope(&d[..6]).is_none());
+    let mut wrong_tag = d;
+    wrong_tag[0] = AUDIO_MAGIC;
+    assert!(decode_rumble_envelope(&wrong_tag).is_none());
+}
+
+#[test]
+fn rumble_envelope_seq_gate_drops_reordered_stale_start() {
+    use crate::input::GamepadSnapshot;
+    // The client-side reorder gate (reused verbatim from gamepad snapshots): a stale start
+    // arriving after a stop must not re-light the motors.
+    let stop = decode_rumble_envelope(&encode_rumble_datagram_v2(0, 0, 0, 10, 0)).unwrap();
+    let stale_start =
+        decode_rumble_envelope(&encode_rumble_datagram_v2(0, 0x8000, 0x8000, 9, 400)).unwrap();
+    let stop_seq = stop.envelope.unwrap().seq;
+    let stale_seq = stale_start.envelope.unwrap().seq;
+    // Nothing applied yet → the first update always passes.
+    assert!(GamepadSnapshot::seq_newer(stop_seq, None));
+    // The reordered older start does NOT supersede the stop.
+    assert!(!GamepadSnapshot::seq_newer(stale_seq, Some(stop_seq)));
+    // A genuine later renewal does.
+    assert!(GamepadSnapshot::seq_newer(11, Some(stop_seq)));
+    // Wraps: seq 1 supersedes 254.
+    assert!(GamepadSnapshot::seq_newer(1, Some(254)));
+}
+
 #[test]
 fn mic_datagram_roundtrip_and_disjoint_from_audio() {
     let opus = [0x5Au8; 80];