dweb §7: build + review the inbound/unattended-action security model before enabling the unattended messaging surface

Forward gate split out of #15 (now closed — the mandatory release pieces shipped: the kill switch in PR #14, and the unattended/inbound surface stays off by default).

What this gates

Turning on any unattended surface where the agent acts on inbound peer messages. Until the model below is built and reviewed, that surface must stay off — the agent must not act on inbound peer messages.

Required before the unattended surface is enabled

Per docs/specs/FEATURE-FIRST-CLASS-MESSAGING.md §7:

• Tier topology — the inbound trust tiers (known peer / contact / stranger) and what each is allowed to reach.
• Two-layer fail-closed clamp — inbound → unattended-action defaults to blocked; both layers must independently fail closed.
• Rate cap — per-peer / global inbound rate limiting.
• Consent grants — per-peer / per-capability grants gating what an inbound message can trigger (mirrors the capability-surface grant/quota template, DECISIONS #21).
• Vault posture — what inbound handling may touch while locked/unlocked.
• Dedicated security review — its own review pass before enabling (spec §7.8).

Current state (for context)

• The transport primitive exists: peerd-distributed/messaging/direct.js (ch=3, 1:1, structurally un-relayable, DTLS in transit, signed-but-unsealed body). It is not wired into the agent loop or any SW route — inbound does not reach the agent today.
• The kill switch (PR #14, on main) is the master fail-closed backstop: dweb/base/stop persists dwebEnabled=false and tears down the live mesh; confirm-gated "Stop the network" control in the home Network section.
• The dweb remains preview-channel only (the store build prunes peerd-distributed/).

Done when

The §7 model is implemented behind the unattended surface, has passed its dedicated security review, and only then is the unattended/agent-acts-on-inbound surface allowed to turn on (default still off; explicit user opt-in).

Start with docs/specs/FEATURE-FIRST-CLASS-MESSAGING.md §7, then inspect peerd-distributed/messaging/direct.js and the dweb/base/stop kill switch for the existing transport and fail-closed controls. Define and implement the tier, clamp, rate-cap, consent, and vault rules, then complete the dedicated security review; the unattended surface must remain off by default until review passes.