fix(core): split WIRE_VERSION from ABI_VERSION — new clients locked out of every deployed host

ABI_VERSION was doing double duty: the embeddable C surface AND the punktfunk/1
Hello/Welcome version that hosts equality-check. The WoL feature's v3 bump added
a client-local FFI function without changing a single wire byte — and every new
client started refusing against every deployed host ("ABI mismatch: client 3
host 2", observed live Deck → Bazzite). The wire now carries its own
WIRE_VERSION (still 2); ABI_VERSION stays 3 for the C header and the mgmt API's
informational field. Bump WIRE_VERSION only when the handshake/planes actually
change incompatibly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/punktfunk1.rs

@@ -585,10 +585,10 @@ async fn serve_session(
         // the `handshake` future re-decodes for the real session — a few dozen bytes, negligible.
         let gate_hello = Hello::decode(&first).map_err(|e| anyhow!("Hello decode: {e:?}"))?;
         anyhow::ensure!(
-            gate_hello.abi_version == punktfunk_core::ABI_VERSION,
-            "ABI mismatch: client {} host {}",
+            gate_hello.abi_version == punktfunk_core::WIRE_VERSION,
+            "wire version mismatch: client {} host {}",
             gate_hello.abi_version,
-            punktfunk_core::ABI_VERSION
+            punktfunk_core::WIRE_VERSION
         );
         let fp = endpoint::peer_fingerprint(&conn);
         let known = fp
@@ -654,10 +654,10 @@ async fn serve_session(
     let handshake = async {
         let hello = Hello::decode(&first).map_err(|e| anyhow!("Hello decode: {e:?}"))?;
         anyhow::ensure!(
-            hello.abi_version == punktfunk_core::ABI_VERSION,
-            "ABI mismatch: client {} host {}",
+            hello.abi_version == punktfunk_core::WIRE_VERSION,
+            "wire version mismatch: client {} host {}",
             hello.abi_version,
-            punktfunk_core::ABI_VERSION
+            punktfunk_core::WIRE_VERSION
         );
         // The pairing gate (require_pairing → paired? else park for delegated approval) ran above,
         // before this future, so a client reaching here is paired (or the host is `--open`).
@@ -805,7 +805,7 @@ async fn serve_session(
         let mut key = [0u8; 16];
         rand::thread_rng().fill_bytes(&mut key);
         let welcome = Welcome {
-            abi_version: punktfunk_core::ABI_VERSION,
+            abi_version: punktfunk_core::WIRE_VERSION,
             udp_port,
             mode: hello.mode,
             // The post-GameStream point of punktfunk/1: Leopard GF(2¹⁶) FEC + real encryption.