protocol: bound the socket writes and stop sending on a broken frame (ibx#254)

[userFRM]

Problem

No socket in the engine had a write timeout — set_write_timeout was called nowhere in src/. Reads were bounded; writes were not.

The hot loop is one thread driving all three transports, and every outbound message goes out through a blocking write on it: order submits, cancels, subscriptions, and the heartbeats themselves. A peer that stops draining without closing blocks that thread, so liveness cannot be evaluated, shutdown cannot be serviced, and a reconnect cannot be polled. The failure is self-defeating: the heartbeat exists to detect a dead peer, and it is the write that blocks on it.

What this changes

One construction path. Both constructors reach the socket through from_stream, so a transport cannot be given a different set of timeouts by being built down a different path, and there is a single place the bound can be dropped from.

A broken frame ends the transport; a stalled one does not. Outbound frames are HMAC-chained, so a timed-out write needs more care than a retry. write_frame tracks how much of the frame reached the socket:

• part of it went out — the peer holds a prefix it cannot verify and every later frame would be signed from state it does not share. That connection is finished, and every subsequent send is refused rather than putting more on the wire.
• none of it went out — nothing reached the wire, the chain is intact, and the frame can go again. A peer that is merely slow does not cost the transport.
• interrupted by a signal — retried, counted as neither.

The bound is on a single write syscall rather than a whole frame, so a peer draining a trickle keeps resetting it. The case it exists for is the peer making no progress at all, which trips the first timeout; a peer that stalls indefinitely reaches the liveness deadlines, which is where it belongs.

The keep-up-to-date historical request no longer advances its signing IV for a frame that never went out. That IV is derived from the frame, so committing it before the send desynchronises the chain and the next authentic frame no longer verifies. It is now held across the send and committed only when the frame is away, along with the send timestamp the liveness clock reads.

What this does not do

It does not treat an abandoned write as a disconnect. That belongs with the reconnect paths, and three of them do not currently support it — each reachable today through the read-side liveness path, none introduced here:

• HMDS sets its disconnected flag without releasing the connection, so maybe_spawn_hmds_reconnect returns early forever (hmds: a liveness timeout leaves the connection in place, so the HMDS reconnect never runs #367);
• the farm's handle_disconnect clears instrument_md_reqs, the list its own reconnect resubscribes from (farm: reconnect resubscribes from the collection disconnect clears, so every farm reconnect comes back with no L1 data #368);
• a request whose write fails is still recorded as pending, with no response and no rejection (ccp: a matching-symbols request is recorded as pending even when it was never sent, and nothing times it out #369).

Until those are fixed, recovery stays on the existing route — the read deadlines — and the write bound is what stops the thread being held meanwhile.

Tests

• a_write_timeout_is_configured_on_both_constructors — the bound is set, the read cadence is unchanged, and a fresh connection writes.
• the_write_bound_stays_within_the_liveness_cadence — the bound cannot outlast the liveness probe interval.
• only_a_frame_that_partly_went_out_finishes_the_transport — stall with nothing sent is retryable; the same error mid-frame is not; a hard error never is.
• a_failed_write_finishes_the_transport — send_raw, send_fix and send_fixcomp are all refused afterwards, and no sequence number is consumed.

Each fails by name against a compiling reversion of the production change it covers.

Closes #254.

Test plan

• Mutation: removing set_write_timeout fails a_write_timeout_is_configured_on_both_constructors by name.
• Mutation: raising the bound to 50s fails the_write_bound_stays_within_the_liveness_cadence.
• Mutation: treating every error as recoverable fails only_a_frame_that_partly_went_out_finishes_the_transport.
• Mutation: letting send_fixcomp bypass the latch, and letting the latch stop refusing, each fail a_failed_write_finishes_the_transport.
• Both constructors reach the socket through one function, so the bound cannot be present on one transport and missing on another.
• cargo check --offline clean on --lib, --lib --features python, --bins, --examples, and each integration target individually.
• tests/ib_paper_compat compared against a clean checkout of the base commit — identical sorted diagnostic sets.
• cargo test --offline --lib — only the two known config::expiry_tests failures, which fail on the base commit for missing legacy tzdata (fixed separately in config: resolve the legacy timezone names IB states its times in (ibx#335) #336).