Rust consumer: run the spec vectors against pluto

[pinebit]

Summary

Adds consumers/rust/, a standalone Cargo package that runs all nine published vector suites against an unmodified pluto checkout. It path-depends on a sibling ../pluto and is never copied into pluto, so a spec-repo user can test the current pluto implementation independently. This is the Rust counterpart to consumers/go/, which does the same for charon.

Also adds plans/pluto-conformance.md, the plan this was executed from, which carries the per-suite Results table and the Findings section, and one spec-side change the findings called for: charon_anchor.json gains an "Extended 1.5s proposer round-1 timeout (proposal_timeout)" behaviours-ladder entry (v1.9.0), with the matching README compatibility-table row and a sentence in docs/dv-spec/consensus.md's timer prose stating the proposer round-1 exception the reference implementation and vectors already carried.

Tested against pluto 67088a2. 31 Rust tests, all green. Both FAIL-class findings were re-proven by differential execution (a charon hashProto probe for the map-entry divergence, a layered serde probe for the cluster-parsing one), and every pluto file:line citation in the findings was re-audited against source.

Verdicts

Suite	Verdict
secp256k1_signatures	PASS
bls_threshold	PASS
priority_scoring	PASS (18/18, driven end-to-end through the public Prioritiser API)
qbft_hashing	FAIL — 23/25 agree; 2 pinned divergences
cluster_hashing	FAIL — pluto rejects charon-legitimate JSON shapes
timer_deadlines	PASS with ProposalTimeout enabled (the vectors' assumption); the default-config divergence on 9 PROPOSER/round-1 cases is ABSENT-OK against the ladder entry this PR adds; deadline ABSENT-OK; start-delay UNREACHABLE
qbft_msg_limits	5 match, 6 ABSENT-OK; wire-size 4/4 match
qbft_decided_resends	ABSENT-OK (pluto has no rebroadcast limiter)
parsigex_sender_binding	cases ABSENT-OK; peer_map UNREACHABLE

ABSENT-OK means the divergence is covered by a charon_anchor.json behaviours-ladder entry postdating pluto's charon-v1.7.1 parity anchor; those are pinned in code so they fail when pluto catches up. UNREACHABLE means no public API path exists from an external crate — a coverage gap, not a pass.

Divergences found

• Protobuf map-entry encoding. prost omits default-valued map-entry key and value fields; charon's Go marshaler emits them. UnsignedDataSet entries with an empty key or empty value therefore encode, and hash, differently. Confirmed by differential execution: a Go probe running charon's hashProto (core/consensus/qbft/msg.go) on both cases reproduces the vector bytes exactly. Reachable only via malformed or adversarial wire input, per code inspection of charon's encode path.
• Cluster file parsing. pluto rejects three JSON shapes charon legitimately produces: operators: null and validator_addresses: null (Go marshals nil slices as null), an absent partial_deposit_data key (Go omits it via omitempty), and an absent timestamp. A layered probe proved this blocker set complete for the shipped cases (name and deposit_amounts are already handled); charon omitempty fields the cases don't exercise may hide more instances of the same missing-#[serde(default)] root cause.
• Proposal-timeout default. pluto has Feature::ProposalTimeout off by default, matching charon v1.7.1; charon at the spec anchor has it on, promoted to stable in v1.9.0. Default-configured pluto diverges from the vectors on all 9 PROPOSER/round-1 cases — ABSENT-OK against the ladder entry this PR adds, and pinned by a test that names it.
• Justification cap. pluto caps justifications at 4 * node_count(), which is neither charon v1.7.1's absence of a cap nor the spec's 2n. Now pinned at its exact boundary.
• DKG partial-signature verification. pluto's DKG wires parsigex with verification skipped by design (dkg/src/node.rs::setup_p2p), and the aggregation-time check that validates share indices lives in a private module, so the lock-hash exchange verifies nothing per message.

Notes for this repo

• The behaviours-ladder gap the findings identified (no entry for the proposal-timeout stabilization, though the vectors depend on it) is fixed in this PR, in its own commit, together with the README compatibility-table row tests/test_release.py enforces.
• The real_keys_3_of_4 lock's operator EIP-712 signatures are placeholders, so verify_signatures short-circuits before the BLS-aggregate and node-signature checks that case exists to exercise. An external consumer cannot reach them; the Go consumer only can because they are in-package in charon. Recorded in the plan, not acted on.

tox.ini gains one skip so codespell does not scan the gitignored Cargo build directory.