feat(share): add cross-loader friend worlds and direct joining

[robinbraemer]

Intent

Ship Connect Share as a secure, friends-first way to link once and join each other's single-player worlds across changing networks, using direct libp2p when possible and Connect as the managed internet fallback.

PR #94 intentionally remains open and unmerged until the remaining release gates are satisfied.

What changed

• Adds shared Kotlin/Arrow social, admission, recovery, presence, privacy, and transport logic.
• Adds client adapters for Fabric 1.20.1, 1.21.1, 1.21.11, and 26.2; Forge 1.20.1; and NeoForge 1.21.1.
• Supports persistent friend links, mutual request convergence, removal convergence, join requests, follow-next-session, world presence, host notifications, and saved endpoint identity import/reuse.
• Uses direct libp2p across LANs and changing networks when reachable, with Connect fallback when direct internet traversal is unavailable. Friend requests themselves remain direct libp2p.
• Preserves native loader networking contracts, including Forge logical-server threads and Forge's native login negotiation.
• Adds fail-closed admission, privacy, secret-redaction, compatibility, recovery, artifact, and real-client E2E coverage.
• Adds a manual-only marketplace release workflow with artifact checksums/attestation and mandatory project/credential gates.

Release-candidate evidence

• ./gradlew clean :share:fabric-1-20-1:build :share:fabric-1-21-1:build :share:fabric-1-21-11:build :share:fabric-26-2:build :share:forge-1-20-1:build :share:neoforge-1-21-1:build --no-parallel passed from a clean tree.
• The exact clean artifacts were installed into twelve isolated Prism profiles and proven host-to-guest on macOS arm64 for all six loader/version pairs. Each run proved discovery/activity, approval, native login, host join, and guest world load without packet-rejection or ref-count errors.
• Moxy's terminal admission-denial path was merged, deployed, and proven against production without degrading into a generic timeout or hub join.
• No-mistakes run 01KZ4TSJA2BZQZTA4NGSX6PE4A passed tests, documentation, lint, guarded push, PR update, and GitHub CI. GitHub workflow run 30858595480 passed all eight jobs, including both Java builds and every supported adapter lane.
• The no-mistakes review worker was unavailable because its external Codex quota was exhausted. Earlier admission findings from that historical run are already fixed by peer-bound one-shot proofs plus bounded/expiring preapprovals and their regression tests.

Exact hashes, test cases, real-client observations, restored test-only settings, and known remaining platform coverage are recorded in docs/connect-share-adoption-evidence.md and docs/connect-share-known-issues.md.

Gates intentionally not crossed

• Not merged: this PR remains open for review and additional OS/architecture coverage.
• Not published to marketplaces: the dedicated Modrinth/CurseForge project IDs and release tokens are not configured. The workflow fails closed and was not dispatched.
• Discover kept separate: public endpoint discovery is tracked by Epic: Connect Discover — the open directory for Minecraft servers #121. Its contract-first first slice is Connect Discover: define the public listing contract and open read API #122 so public listings cannot accidentally enumerate private, friend-only, or Share endpoints.

Product boundary

Connect Share exposes only consented friend presence and host-approved joining. It does not make private endpoints searchable, does not use public directory state as admission authority, and does not expose endpoint credentials, peer/session identifiers, internal routes, or player identity data.