[puddly]

This is a massive rewrite that still needs to be more thoroughly tested.

The goal is to migrate as much send logic and state tracking as possible into a single sans-io crate that manages send tables (Unicasts, UnroutedUnicasts, and Broadcasts) and emits discrete actions when driven. The benefit of this approach is that we can consolidate the various tables and reactors into one and introduce a bunch more compile-time safety guarantees.

AI Summary

Fixes

• Every send has a deadline. A stalled radio no longer leaves frames queued forever. New handoff_timeout tunable and HandoffTimeout status.
• The APS-ack timeout starts at handoff, not at the request. A slow route discovery or a sleepy destination no longer eats the ack window.
• One budget token per send. Retransmissions and retries no longer take new tokens, so they cannot be refused mid-flight.
• At most one copy of a broadcast is outstanding. A quorum heard while a copy was queued no longer sends it anyway.
• Cancel settles the send immediately, or refuses it while it is in the radio. It no longer reports success for a send past cancelling.
• Raw MAC frames get the frame-pending bit at transmit time.

Compile-time guarantees

• Table actions are must_use; dropping them is a build error under clippy.
• commit_sends takes the lock guard by value, so actions always run after the unlock.
• dequeue returns a must_use receipt that only transmitted consumes, so every frame handed to the radio is reported back.
• Helpers that take &mut ZigbeeCore or &Nib cannot lock the core, so they cannot deadlock under it.
• The budget's record size is asserted at compile time.