Six small follow-ups from Siggi's re-review (bsv-blockchain#832) and Copilot nits left
explicitly deferred for a follow-up PR.

1. bytesToBlockHash no longer writes to os.Stderr (peer_registry_grpc.go).
   Signature is now (Hash, error); protoToPeerInfo accepts a ulogger.Logger
   and surfaces the error via the structured logger. PeerRegistryClient
   gains a SetLogger method mirroring the registry's, plumbed from
   daemon_stores so production decoder warnings route through ulogger.

2. StartPeriodicSave moves the savePeerRegistryPeriodically loop onto
   the registry's own WaitGroup (peer_registry.go). Close() now drains
   it alongside ban-decay and TTL cleanup; tickers after Stop are
   impossible. The Server.go wrapper is gone.

3. persistedRegistry.Version is enforced
   (peer_registry_persistence.go). A blob whose Version is newer than
   persistedRegistryVersion is rejected with a clear error rather than
   silently dropping unknown fields on downgrade.

4. AddBanScore renames the param points -> defaultPoints
   (peer_registry.go). The comment now states explicitly that
   banConfig.ReasonPoints overrides the caller's value for configured
   reasons. Interface and gRPC client follow.

5. SetLogger / log() use atomic.Value
   (peer_registry.go). Previously the field was written under r.mu and
   read without; production flow happens to be single-call-then-many-
   reads, but the asymmetry was a footgun if SetLogger ever becomes
   runtime-reconfigurable. Switched to atomic.Value via a loggerHolder
   wrapper so concurrent log() readers are race-free without taking
   r.mu.

6. Sidecar archive key uses UnixNano
   (peer_registry_persistence.go). Second granularity made two
   corruption events in the same second collide via
   WithAllowOverwrite=true.

Tests:
- TestPersistence_RejectsFutureVersion (Version gate)
- TestRegistry_SetLoggerNoRace / _NilIsNoop (atomic logger)
- TestPersistence_CorruptBlobArchivedToSidecar updated for nanosecond
- TestBlockchain_SavePeerRegistryPeriodically rewritten around
  StartPeriodicSave + Close drain
- TestGRPC_BlockHashBytes* now check the new (h, err) shape

go vet clean. 1162 tests pass with -race across blockchain, p2p, daemon.

…ockers

Two blockers from the PR bsv-blockchain#988 review, plus the two non-blocking nits
called out alongside.

## Blocker 1 — Sidecar test was platform-dependent

The previous TestPersistence_CorruptBlobArchivedToSidecar probed the
keyspace at 1µs steps to find the archived blob. macOS's UnixNano() is
microsecond-aligned (mod 1000 == 0), so the loop happened to land on the
real key. Linux returns true-ns timestamps, which means the loop misses
~99.9% of the time. The test would have failed in CI.

Fix: surface the archive key from the registry. CentralizedPeerRegistry
now records the most recent sidecar key in an atomic.Pointer[string],
exposed via LastCorruptArchiveKey(). The test reads the key directly
instead of guessing it from wall-clock bounds — no more clock-resolution
dependency. Also useful for operator post-mortems (the key can be
exposed via gRPC / diagnostics later).

## Blocker 2 — Version rejection was undone by the next save

Load returned an error on future-version blobs but Server.go only
logged Warnf and continued. StartPeriodicSave still launched. On the
first tick (or the final shutdown Save), an empty Version=1 envelope
overwrote the operator's future-version data via
WithAllowOverwrite=true. The version check was therefore documentation,
not protection.

Fix: registry-level saveDisabled atomic.Bool. Load detects
errFutureRegistryVersion and latches the flag before returning. Save
becomes a no-op when saveDisabled is set; StartPeriodicSave refuses to
start. saveDisabled is one-way — clearing it requires constructing a
fresh registry, which is the correct contract (the operator must
explicitly decide whether to roll forward or restore a backup).

TestPersistence_FutureVersionDisablesPersistence verifies the end-to-end
behaviour: the original bytes on disk are unchanged after Load, Save,
and StartPeriodicSave + Close.

## Nit 1 — PeerRegistryClient.logger now atomic.Value

Matches the hardening applied to CentralizedPeerRegistry in bsv-blockchain#988. log()
runs on every GetPeer / ListPeers RPC, so a plain field + post-
construction SetLogger was the same race shape that motivated the
registry change. Same loggerHolder wrapper, same nil-no-op semantics,
plus TestPeerRegistryClient_SetLoggerNoRace as a -race guardrail.

## Nit 2 — GetPeerRegistryClient guarded by sync.Once

Pre-existing race in the singleton init: nil-check + assign without a
mutex meant two concurrent first-callers could each create a client
(and only one would be retained). Now serialized by Stores.peerRegistryClientOnce.
Error path stored on Stores.peerRegistryClientErr so the Once contract
is preserved (the function is called once; the error is replayed). Other
singleton getters in this file have the same shape but are out of scope
for this PR.

Tests:
- TestPersistence_CorruptBlobArchivedToSidecar rewritten around
  LastCorruptArchiveKey (Linux-safe).
- TestPersistence_FutureVersionDisablesPersistence: end-to-end blob
  protection.
- TestPeerRegistryClient_SetLoggerNoRace and _NilIsNoop.

go vet clean. Tests pass with -race on services/blockchain,
services/p2p, daemon.