ensemble: route prompts to workers found by gossip

[adiled]

Closes #63.

What

A prompt naming a model that no local bee advertises got chi:"error", even when a peer humd advertised a worker for it over hum/hives/announce. Now it routes there.

The far side already worked. humd parses from on ensemble-sourced prompts, records sid_origins, and routes worker replies back to the origin — so the missing piece was exactly one hop.

How

• Ensemble::hive_discover_all() — unfiltered manifests. hive_discover(name) is now a filter over it.
• humd holds heard manifests keyed by the humd that can route to them (the bee has no ensemble presence; only its humd is dialable), inner-keyed by bee hid / nestler id / name.
• On a local worker miss: pick a connected peer advertising that model, set to/from, route.
• A no-worker error now routes back to a remote caller too, instead of dying in the local session and leaving the origin to time out.
• Re-advertise on PeerAdd. A bee advertises only when it handshakes with its own humd, which a peer reconnect does not re-trigger — so reconnect left peers invisible.
• PeerRemove drops that humd's manifests; selection ignores any humd absent from ens.peers(), so a manifest cannot outlive its peer.

Proof

sim/tests/remote_discovery.rs — two humds. The laptop has no worker and sends a bare chi:"prompt" naming only a model; the server's worker is the sole advertiser and the laptop has never heard of it.

Fails without the fix:

laptop never got chi:finish from the discovered worker — discovery did
not route the prompt across the mesh
Some("no worker bee advertises model 'claude-opus-4-7'")

Passes with it. Full suite 210 passed / 0 failed; clippy clean under the CI command.

Notes

• Selection is ens.peers()-gated rather than lease-gated. A manifest has no timestamp and there is no re-advertise heartbeat, so TTL eviction would drop live entries. The peer set is the honest liveness signal, and it is free.
• A failed forward falls through to the error reply rather than returning, so a dead peer cannot hang the caller.
• Kept selection to one source: model match against manifests. pick_overflow_peer still selects by caps/free_slots for overflow — deliberately untouched, see below.

Not in scope

pick_overflow_peer and manifest-discovery are now two selection mechanisms that can drift. Worth unifying, but that is a behaviour change to overflow routing and deserves its own issue.

Address-level discovery is also still hand-rolled: IrohTransport::connect requires an iroh: hint and passes no relay URL, so an EndpointId alone cannot dial us. iroh 1.0's endpoint_info (Pkarr + DNS, with UserData for a descriptor) is the substrate for that, and ENS/chain would be AddressLookup impls. Separate crate, separate issue.