Merge m3a: brokerd's decision path (M3a)

Tasks 01 to 22, the review, and task 23 (the review fixes, with a second,
independent review of them). The one conflict, docs/implementer-lessons.md,
had the same T18 and T19 on both sides; m3a's T20 to T22 follow them.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/plans/M3a/files/crates/brokerd/tests/support/client.rs

@@ -53,11 +53,13 @@ pub fn open(
     client
 }
 
-/// The next frame, waiting at most ten seconds.
+/// The next frame, waiting at most ten seconds. Once the handler has closed its end, macOS
+/// refuses the timeout with EINVAL (22); the frame is buffered by then and the read cannot block.
 pub fn next(stream: &mut UnixStream) -> Envelope {
-    stream
-        .set_read_timeout(Some(Duration::from_secs(10)))
-        .unwrap();
+    if let Err(e) = stream.set_read_timeout(Some(Duration::from_secs(10))) {
+        let peer_closed = cfg!(target_vendor = "apple") && e.raw_os_error() == Some(22);
+        assert!(peer_closed, "set_read_timeout: {e}");
+    }
     proto::read_frame(stream).unwrap()
 }