feat(directory): publish safe reachability hints

[randomblocker]

What changed

• publish the optional DACS-1 reachabilityHint for active listings with a signed HTTPS publicEndpoint
• reuse fresh observations for one hour, render stale observations as unknown, and rotate bounded work across due listings
• cap each reindex to 20 probes by default with concurrency 5; both limits are operator-configurable within hard bounds
• show the non-authoritative endpoint status on service pages and describe it in the machine schema and llms.txt
• factor well-known crawling and reachability onto one credential-free bounded HTTPS client

Probe safety

The shared outbound client:

• permits only HTTPS on port 443 with no URL credentials
• rejects loopback, private, link-local, shared-address, unspecified, multicast, reserved, documentation, metadata-equivalent and IPv4-mapped IPv6 targets
• resolves every hop, rejects the whole DNS answer set if any address is forbidden, and pins a fresh socket to one approved IP
• disables socket pooling, revalidates every redirect, and caps redirects
• applies connection and whole-request deadlines
• requests identity encoding, rejects encoded bodies, and caps response bytes
• constructs explicit headers only, so cookies and ambient authorization are never forwarded

Probe results are attached only after listing, revocation, identity and reputation verification. They cannot add/remove a listing or change any trust result. HTTP responses prove network reachability only; policy-blocked targets remain unknown without being contacted.

Validation

• npm test — 153 passed
• npm run typecheck
• npm run build
• live read-only probe of https://example.com/ returned reachable
• regression coverage for stale hints, fresh-cache reuse, trust-field isolation, bounded round-robin work, private/metadata rejection, IPv4-mapped IPv6, and chain reset

Coordination

PR #70 establishes the current Not measured by Directory evidence wording and should land before this PR; the rebase will replace that state only when a fresh hint exists. PRs #71 and #73 also touch scanner state/reindex orchestration. They should land first, after which this PR can be rebased to resolve the mechanical overlap while keeping the reachability scope independent.

Closes #60