feat: resolve issues #27, #29, #30, #31, #33, #34

[IFindMe]

PR: resolve issues #27, #29, #30, #31, #33, #34

Branch: issues/27-29-30-31-33-34 (off main, commit 9d21d37)
Base: main

Summary

One coordinated batch that reconciles docs to code and closes six open issues.
All Rust changes were verified in a rust:1.98 container (Linux CI scope:
--workspace --exclude anyplug, matching upstream CI).

Issues closed

• Reconcile docs to code — name module ownership in CONTEXT.md, fix 12+ divergences #27 — Reconcile docs to code: added an authoritative "## Module ownership"
  section to CONTEXT.md naming one owner per concern; aligned
  CLAUDE.md/ARCHITECTURE.md/PROTOCOL.md/ROADMAP.md/README.md/
  docs/BUILDING.md/docs/PERFORMANCE.md with the code; added
  docs/adr/0006-what-not-to-borrow.md.
• Wire HotplugMonitor into Server, or delete it — v1.0 reliability primitive is fiction #29 — Hotplug wire-or-delete: chose delete. The unwired poll-based
  hotplug module and its tests were removed; USB hot-plug detection is deferred
  to v1.1, blueprint preserved in ADR-0005.
• Collapse discovery TXT into one seam in usbip-core — Rust + Kotlin reuse #30 — Collapse discovery TXT into one seam: moved the device TXT wire
  format into usbip_core::discovery_txt (encode + decode + DiscoveredDevice).
  Server advertises and delegates encode; client now decodes discovery responses.
• Adopt "only place that does X" discipline — name module ownership, delete 79 lines of dead metrics #31 — "Only place that does X" + dead metrics: deleted 4 never-wired
  Prometheus statics; kept the live /metrics router and ENCRYPTION_ENABLED.
• Adopt per-thread high-water-mark CAS in URB receive loop — skip cross-thread CAS on ~99% of packets #33 — Per-thread high-water-mark CAS: added private per-thread
  high-water-mark latency sampling (latency_hwm.rs) in the URB receive loop,
  broadcasting a LatencySample only on a new global peak (cuts cross-thread
  CAS/broadcast on ~99% of packets), plus a criterion bench. No public API
  change; LatencySample shape unchanged.
• Verify in-place AEAD decrypt is in use — adopt if not #34 — In-place AEAD decrypt: audited decrypt call sites; confirmed
  decrypt_in_place is the production decrypt path (crypto_stream.rs:146);
  added audit comments and an in-place-vs-allocating criterion bench.

What changed

• New files: shared/usbip-core/src/discovery_txt.rs,
  server/usbip-server/src/latency_hwm.rs,
  shared/usbip-core/benches/aead_inplace_bench.rs,
  server/usbip-server/benches/urb_high_water_mark.rs,
  docs/adr/0006-what-not-to-borrow.md.
• Deleted: server/usbip-server/src/hotplug.rs,
  server/usbip-server/tests/hotplug_integration.rs.
• Modified: docs + 4 counter/gauge statics removed from metrics.rs; server &
  client wired to the discovery TXT seam; URB loop threaded latency HWM.

Verification (all GREEN, Linux CI scope)

• cargo test --release --workspace --exclude anyplug → pass
• cargo clippy --workspace --exclude anyplug -- -D warnings → clean
• cargo fmt --all -- --check → clean
• cargo bench --no-run --workspace --exclude anyplug → builds (new benches)

Notes

• The windows crate is not built on Linux (CI-excluded); its MdnsBrowser
  public surface used by windows/src/actions.rs is unchanged (new decode
  helpers are purely additive).
• Reviewer: APPROVE after addressing 3 doc findings (resolved); see
  AgentsReport/reviewer/2026-09-04_batch-review.md.
• Issue macOS client (DriverKit VHCI equivalent) #13 (macOS client) is out of scope ("ready-for-human").