refactor(core): scan only addressed ids for custody; share frag plan

- Add Store::for_each_addressed_id (default: every id; MemStore filters)
  so custody selection no longer clones every broadcast observation on
  each poll.
- Factor fragment sizing into frag::plan and MAX_FRAGMENTS, used by both
  frag::fragment and the exchange, and by the reassembler's bounds.
- Document `to` in the Observation::id hash input, matching the
  addressed-delivery plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tines-core/src/mem_store.rs

@@ -110,6 +110,14 @@ impl Store for MemStore {
         }
     }
 
+    fn for_each_addressed_id(&self, f: &mut dyn FnMut(&ObservationId)) {
+        for (id, held) in self.map.iter() {
+            if held.obs.to.is_some() {
+                f(id);
+            }
+        }
+    }
+
     fn for_each_topic(&self, prefix: &[u8], now: Tick, f: &mut dyn FnMut(&Observation)) {
         for held in self.map.values() {
             if held.obs.topic.starts_with(prefix) {