fix(gateway): keep Realm-core authority during outages

[Mathih13]

When Realm-core became unavailable, the Gateway could send Mail, party and Loot Roll operations to a World Shard. Mail recovery could then commit a letter to the wrong database and clear its Escrow. Several Mail handlers also skipped error propagation when debug logging was disabled.

Use one fallible Realm-core lookup for all callers. A configured outage returns an error, including when the initial connection failed. Mail recovery logs the error and retains Escrow for retry. Transport Loss from an explicit Mail action ends the World Session at every log level. Recovery remains best effort, including recovery triggered by a mailbox visit. Realm Presence reports unknown Whereabouts when it cannot exclude a pending Transfer. Single-Shard operations keep their local path.

What you verified

• cargo test -p lyracore-gateway --offline -- --quiet: 2,020 passed, 0 failed, 31 ignored across all targets.
• cargo clippy -p lyracore-gateway --all-targets --all-features --offline -- -D warnings: passed.
• cargo fmt --all -- --check: passed.
• git diff --check: passed.

Tests cover an outage after session admission, unchanged items and copper before send, retained Escrow, delivery once after recovery, unchanged party membership, blocked local Loot Roll votes, and unknown Whereabouts. The socket test confirms that a Mail Transport Loss closes the World Session and releases its queue seat.

CI also passed on merge revision e1546d065d8ccbf235b9d5b0ba07922c896a4efc, which combines head a32f6928 with main a31f54ce:

• Rust: full workspace tests and Clippy, formatting, Wasm, and Official Packages.
• Module durable tests and Gateway bindings: all three jobs passed, including Gateway routing, party, and Transfer checks.
• Runtime Scripts: passed.

Two independent adversarial reviews found no blocking defects. They inspected the Coordinator health checks, Mail commit and payout receipts, recovery callers, party and Loot Roll routing, and Realm Presence.

What you did NOT verify

No real client or production Realm was used. The new outage cases use the Store Fake and a local socket; a dedicated real Coordinator outage test was not added. Local Gateway tests left 31 tests ignored; CI separately ran the durable checks selected by its workflow.

Risk

This changes Gateway routing and outage handling. An explicit Mail request now ends the World Session if Realm-core is unavailable. Mail recovery retains Escrow, and the Loot Roll Relay retains staged rolls for a later attempt. Existing short-lived Group Intents still do not guarantee retry.

Made with gpt-6-astra at high reasoning effort through the Codex harness in T3 Code.

[Mathih13]

Merged as 0e37958 after two independent adversarial reviews. Neither found a blocking defect, and no source changes were needed after review.

The reviews traced the production Realm-core health checks, Mail recovery and idempotency, party and Loot Roll routing, and Realm Presence. All nine CI checks passed on the exact proposed merge, including the full Rust and durable suites. The PR description links those runs and records the remaining verification gaps.

Mail recovery remains best effort, including recovery triggered by a mailbox visit. Short-lived Group Intents still do not guarantee retry. Those existing limits do not permit operations to fall back to World Shard authority. Configured Realm-core outages now preserve that boundary, and direct Mail Transport Loss ends the World Session even when debug logging is disabled.