fix(core): five sweep lows — seal-lane fallback, flush partial, codec echo, idle clamp, pair-name UTF-8

From the 2026-07-20 punktfunk-core quality sweep's adjudicated lows
(~/punktfunk-sweeps/punktfunk-core-2026-07-20.json), each with a
regression test:

- session: the two-lane seal's dead-worker fallback dropped the frame's
  back half and returned Ok with half an access unit; the corpse lane
  was also never respawned. The send-failure arm now reclaims the tail
  (single-lane seals the WHOLE frame) and both failure arms drop the
  lane so the next large frame respawns it. A recv-side death now
  surfaces as an error instead of silent truncation.
- reassemble: Reassembler::reset() left pending_partial parked, so a
  pre-flush stale partial survived Session::flush_backlog and was
  delivered as the first "frame" after a jump-to-live.
- caps: resolve_codec echoed a non-conformant multi-bit preferred byte
  verbatim (downstream from_wire folds it to HEVC — possibly outside
  the shared set). It now isolates one bit of the intersection.
- endpoint: stream_transport_idle only floored the value; an absurd
  operator-supplied idle timeout blew past QUIC's VarInt ms ceiling and
  panicked host startup through the expect. Clamped to 1s..1h.
- pairing: PairRequest::encode cut the device name at a raw byte-64
  boundary, splitting multi-byte UTF-8 (host showed U+FFFD forever);
  it now shares Hello's char-boundary truncate_to.

The frozen-FEC-ceiling finding (reassemble.rs:109) was already fixed on
main by the sweep's high-severity commit — skipped as stale.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-core/src/quic/caps.rs

@@ -91,8 +91,13 @@ pub fn resolve_codec(client_codecs: u8, host_capable: u8, preferred: u8) -> Opti
         return None;
     }
     // Honor the client's preference when the host can also emit it; else fall back to precedence.
+    // `preferred` is a single-bit field by contract but arrives as a raw wire byte — isolate ONE
+    // bit of the intersection instead of echoing the request, so a non-conformant multi-bit
+    // value can never escape as a codec id (downstream `from_wire` folds unknown values to HEVC,
+    // which may not even be in the shared set).
     if preferred != 0 && shared & preferred != 0 {
-        return Some(preferred);
+        let want = shared & preferred;
+        return Some(want & want.wrapping_neg());
     }
     // Precedence: HEVC > AV1 > H.264.
     [CODEC_HEVC, CODEC_AV1, CODEC_H264]
@@ -222,4 +227,24 @@ mod tests {
             0
         );
     }
+
+    #[test]
+    fn resolve_codec_canonicalizes_a_multi_bit_preference() {
+        // A non-conformant peer may stuff its capability MASK into `preferred` — the result
+        // must still be a single bit of the shared set, never the raw multi-bit echo (which
+        // folds to HEVC downstream and can select a codec the client can't decode).
+        assert_eq!(
+            resolve_codec(CODEC_H264, CODEC_H264 | CODEC_AV1, CODEC_H264 | CODEC_AV1),
+            Some(CODEC_H264)
+        );
+        // Several shared preferred bits: still exactly one bit, and one of the preferred ones.
+        let got = resolve_codec(
+            CODEC_H264 | CODEC_HEVC | CODEC_AV1,
+            CODEC_H264 | CODEC_HEVC | CODEC_AV1,
+            CODEC_AV1 | CODEC_HEVC,
+        )
+        .unwrap();
+        assert_eq!(got.count_ones(), 1);
+        assert_ne!(got & (CODEC_AV1 | CODEC_HEVC), 0);
+    }
 }