fix: bound queue memory and recovery for 0.10.1

[SamuelSupe]

Delayed-message statistics, active consumers and legacy Channel checkpoint recovery could exhaust Broker memory, including an OOM before readiness at a 256 MiB limit. Release 0.10.1 keeps delayed deadlines in shared metadata, bounds scans and statistics, compacts legacy DPUB entries during recovery, and preserves explicit REQ attempts and lost-position fences.

The release also fixes deleted-Topic recreation ignoring the requested delivery mode/TTL, heartbeat write timing, completed Operator recovery status, TLS CLI startup, proxy rollout continuity and mobile Console navigation. Recreating reliable delivery clears the old TTL, preventing messages from expiring under the previous policy. The footer uses package metadata. WebSocket TTL live subscriptions and v7/RCC7/RQTMv2 formats remain compatible. Rust statistics callers now handle Result; HTTP endpoints isolate uncertain storage instead of reporting partial successful counts.

The performance workflow calibrates the exact same Broker image in three profiles before running the ten-pair baseline comparison. It keeps the 30-second warmup, 120-second measurement, 5 percent throughput spread, 10 percent p99 spread, resource bounds and integrity/drain assertions. Linux ARM64 Broker and load generator use separate CPU sets within the existing two-CPU quotas; effective CPU placement and quotas are recorded. The job allows 360 minutes to complete calibration plus all comparison pairs and drains. Observation runs outside the Broker cgroup, recording Broker and load generator CPU counters, host utilization, block-device I/O, data filesystem/capacity, memory events, VM and PSI diagnostics. RAM-backed data filesystems are rejected. Release publication downloads uploaded assets and verifies their checksums before promotion.

Validation completed:

• 429 Rust workspace tests, format, checks and Clippy; nine Console UI tests/type checks/build; Helm lint/template and release metadata.
• Exact-source GitHub production-gate success, including seven ASAN fuzz targets and four Go/Python core/secure compatibility matrices.
• Four original Go/Python matrices against the qualified Linux ARM64 package, all final channel drains zero.
• The same valid 8 million message, 128 Channel legacy checkpoint fixture recovered within 256 MiB without OOM.
• Three logical Broker Kubernetes rollout, canary approval, token rotation, leader failover, format fences, persistent backlog and unique-delivery ledger; current Console multi-owner crash recovery.
• Native Chrome six routes, desktop/mobile navigation, Escape focus restoration, search, details, refresh and version metadata. A separate desktop management pass verified scoped unlock, Topic/Channel create and pause/resume, wrong-name/cancel protection, emptying three synthetic messages, native deletion with tombstone protection, and relocking across reload. A targeted policy regression failed before the fix and passed after it for recreated TTL_DISCARD/30 and RELIABLE/no TTL, verified against native Broker state and the actual Chrome form. No console warnings/errors.

Release acceptance: the current source production gate and ARM64 package preflight passed. The 24-hour soak is excluded from this release acceptance. Six hosted same-binary calibration attempts exceeded the unchanged spread limits, so the formal baseline/candidate performance comparison remains unqualified. These calibration results do not identify a candidate regression. Release 0.10.1 proceeds with the completed functional, compatibility, recovery, Kubernetes, Chrome and packaging checks, followed by the main-branch production gate and independent verification of the GitHub tag, five assets and checksums.