refactor(ops): relay UPDATE streaming task-per-tx (slice C) — #1454 phase 5

[iduartgomez]

Problem

Issue #1454 Phase 5 migrates relay operations to the task-per-transaction
driver pattern. Slice A (PR #3910) migrated non-streaming UPDATE relays
(UpdateMsg::RequestUpdate, UpdateMsg::BroadcastTo). Streaming
variants (RequestUpdateStreaming, BroadcastToStreaming) and the
deprecated Broadcasting wire variant were left on the legacy
state-machine path — meaning the last DashMap-resident relay UPDATE
amplifier surface (pre-registered UpdateOp + load_or_init/push)
remained uncovered by the slice A dedup gate.

Solution

Add task-per-transaction drivers for both streaming variants in
operations/update/op_ctx_task.rs:

• start_relay_request_update_streaming — claims inbound stream via
  orphan_stream_registry().claim_or_wait, assembles, deserializes
  UpdateStreamingPayload, applies locally via update_contract,
  emits update_success telemetry. Fire-and-forget: propagation is
  via BroadcastStateChange after local apply.
• start_relay_broadcast_to_streaming — same stream-claim + assemble
  flow, plus pre-merge dedup cache check (amplifier mitigation), WASM
  merge, update_broadcast_applied telemetry, proactive summary
  spawn on success, and the legacy failure classifier
  (log_broadcast_to_streaming_failure + conditional
  try_auto_fetch_contract / send_summary_back_on_rejection).

Key simplification vs PUT slice B: UPDATE streaming relays are
fire-and-forget. No downstream pipe_stream, no upstream reply, no
request-response bookkeeping.

Dispatch gate in node.rs routes both variants under the same
source_addr.is_some() AND !has_update_op(id) gate as slice A.
Deprecated UpdateMsg::Broadcasting stays on the legacy no-op
handler; pre-registered UpdateOps (GC / originator-loopback) still
fall through to legacy.

Shared counter RELAY_UPDATE_DEDUP_REJECTS and shared tx set
active_relay_update_txs ensure dedup is unified across slice A +
slice C; separate RELAY_UPDATE_STREAMING_* counters give operators
independent visibility during the ramp.

Testing

• 50 UPDATE unit tests pass (including 9 new slice C structural pin
  tests + 3 updated node.rs dispatch pin tests).
• Full cargo test -p freenet --lib passes (2462 passed, 16
  ignored).
• cargo clippy -p freenet --all-targets -- -D warnings clean.
• cargo fmt clean.

Structural pin tests cover: driver existence, dedup-gate usage (both
drivers increment RELAY_UPDATE_DEDUP_REJECTS), orphan-stream claim
via claim_or_wait, fire-and-forget guarantee (no send_and_await,
no pipe_stream), pre-merge dedup ordering (BroadcastToStreaming
calls broadcast_dedup_cache.check_and_insert before
update_contract), failure classification, proactive summary spawn,
and RAII guard cleanup of streaming-specific counters
(RELAY_UPDATE_STREAMING_INFLIGHT,
RELAY_UPDATE_STREAMING_COMPLETED_TOTAL).

Linux-only multi-loopback streaming end-to-end tests remain covered
by existing /freenet:linux-test infrastructure.

Fixes

Partial progress on #1454 Phase 5. After this merges, only the
deprecated UpdateMsg::Broadcasting wire variant + legacy streaming
arms in update.rs:871-1366 remain — Phase 6 wire cleanup will
delete both.

[github-actions]

Rule Review: No issues found

Rules checked: git-workflow.md, code-style.md, testing.md, operations.md
Files reviewed: 5 (operations.md, crates/core/CLAUDE.md, crates/core/src/node.rs, crates/core/src/operations/update.rs, crates/core/src/operations/update/op_ctx_task.rs)

Warnings

None.

Info

• crates/core/src/operations/update/op_ctx_task.rs (test slice_c_drivers_use_tx_dedup_gate) — the dedup gate check scans a hard-coded 1500-byte window from each entry-point function's start. If the preamble (dedup-reject log block) grows past that bound, the assert would pass while scanning dead zone. Low practical risk since both preambles are under 700 bytes today, but a start..dedup_check_pos approach similar to the ordering test would be more robust. (rule: code-style.md — test correctness)

---

Checklist against applicable rules:

• No .unwrap() in production code — new production paths use match/? throughout. ✓
• Fire-and-forget spawns — all GlobalExecutor::spawn calls are for short-lived per-tx work (relay drivers, send_summary_back_on_rejection, send_proactive_summary_notification), matching the established slice A/B pattern. Not lifetime tasks; BackgroundTaskMonitor not required. ✓
• Push-before-send (task-per-tx flavour) — drivers are fire-and-forget and never call send_and_await; the slice_c_drivers_are_fire_and_forget pin test confirms this. ✓
• Dedup gate — both dispatch arms in node.rs are guarded by !op_manager.has_update_op(id), pinned by update_streaming_arms_gate_on_has_update_op. ✓
• Stale documentation — operations.md and crates/core/CLAUDE.md are both updated in-PR to reflect slice C's migration. ✓
• Regression test (refactor: PR) — not a fix: PR; structural pin test requirement does not apply. ✓
• No new biased; select, no retry loops, no unbounded channels, no Instant::now() — none introduced. ✓

---

Rule review against .claude/rules/. WARNING findings block merge.