fix(desktop): preserve timely goodput and independent control dispatch

[rldyourmnd]

Repeated loss-only reductions could collapse native desktop quality despite recent successful timely media goodput. Add a conservative selected-path delivery floor from two populated receipt windows, counting only fully acknowledged timely payload bytes. Keep real delivery/RTT/producer pressure, holds, silence, path changes and negotiated ceilings protective; expose the observed timely bytes/rate in normal metadata health.

This consolidates the validated managed control/decode dispatch correction from #78 and canceled-sync admission fixture correction from #80. It also repairs the real-clock cadence assumption exposed by #80 macOS CI with production cadence functions on an explicit clock. A combined Mac check exposed an independent v1 sync failure; its original log is retained, the negotiated fixture pair now uses loopback with discovery disabled, and failures report both peer reasons. No accepted transfer is retried.

Validation: desktop unit tests 81 passed with no failures/ignores; strict full-workspace/all-target/all-feature Mac Clippy and formatting passed. Combined Mac suites passed 236 tests with 0 failures and one explicit OpenSSH ignore before the final pacing increment; its affected desktop suite and strict lint passed. The initial Linux candidate also finished tests, strict lint and optimized build; its SSH observer reset, so completed log receipts were checked independently. Final immutable candidate Linux qualification and builds are running. Original negative results remain retained; docs/reports/rds-confirmed-goodput-20261002.md states the regression/measurement boundaries. Native physical latency, full-load quality and sustained stability remain open.

Supersedes #78 and #80 after this consolidated implementation and all required checks are qualified.

A bounded independent key (at most 64 KiB, no outstanding media receipts) starts without an extra application pacing delay. QUIC pacing and the key capture barrier remain; debt, larger keys and nonempty/dependent traffic keep their bounds. Explicit output/clock tests cover the 500 ms prior wait and all admission guards. Normal logs now expose pacing waits.

Completed receipts are also retired after an idle producer wait, before deciding whether the next key has an empty media queue. A completed-JoinSet regression checks that the key can start immediately without another IDR or false failure. Final Mac optimized client build and strict lint passed; Linux durable qualification is running on exact source 5f2c1f2.