Build authoritative ACL policy state before advertising or activating the data plane

[forkwright]

Finding

Hamma advertises a capability version that includes ACL delivery but has no authoritative effective-policy state to receive or enforce it.

Evidence

• MapRequest advertises version 68 in crates/dictyon/src/control/mod.rs:326-336.
• crates/hamma-core/src/types.rs:152-197 omits MapResponse.PacketFilter, whose absent/empty semantics have existed since capability version 6.
• Netmap at crates/dictyon/src/control/mod.rs:100-115 has no effective policy state.
• PeerChange.CapMap is parsed at crates/hamma-core/src/types.rs:320-365, but apply_peer_change discards it at crates/dictyon/src/control/mod.rs:510-546; Node has nowhere to retain it.
• Tests establish parsing only and use cap_map: None in behavioral cases.
• The reference contract distinguishes absent packet filter (unchanged) from present empty filter (deny all), and atomically replaces capability-map patches.
• Hamma's README names ACLs in the Phase A feature target, so this is not an optional future protocol field.

Why this matters

If the WireGuard data plane lands on the current model, traffic has no control-plane policy object to authorize it. Treating missing/uninterpretable policy as no restriction would create a fail-open mesh; treating every omission as empty would incorrectly revoke established policy.

Required mechanism

• Add a typed effective-policy state before activating Milestone 4.
• Preserve absent, present-empty, and present-non-empty filter semantics exactly.
• Parse policy into the data-plane matcher before publishing a netmap update; fail closed when a policy update cannot be interpreted.
• Store and atomically replace node/peer capability maps, including revocation.
• Gate advertised capability version on this implemented semantic surface.
• Add full → unchanged → deny-all → replacement → malformed-policy tests proving atomicity and fail-closed behavior.

[forkwright]

Acceptance refinement from the public Phase A graph:

The eventual data-plane constructor must make the dependency order executable, not merely documented. DataPlane::new (or the equivalent activation seam) should consume sealed, externally unforgeable Http2ControlPlane and EffectivePolicy capabilities.

• Implement HTTP/2 over Noise instead of treating Noise records as control RPC boundaries #65 is the only path that can mint Http2ControlPlane after its independent receipt passes.
• An absent packet filter cannot mint EffectivePolicy.
• A present-empty packet filter can mint it, but the value represents deny-all.
• A present non-empty policy mints it only after successful parse/validation.
• Malformed replacement input must preserve the prior complete policy atomically or fail closed.
• Normal CI must include downstream negative-construction coverage (for example, a trybuild fixture); a compile-fail doctest alone is insufficient unless the required gate actually runs doctests.

This keeps contracts/phase-a.toml as the dispatch/order authority while #65/#67 own the real Rust capabilities. Empty typestate scaffolds before those implementations would overclaim and should not land.