On-device packet-ingestion work needs a deterministic, radio-free way to drive realistic mesh traffic into the app, and assurance that the untrusted-input path can't be crashed by a malformed packet. This PR adds an on-device capture-replay transport, a seeded fuzz harness over the ingestion boundary, and the per-packet exception isolation that the fuzzing surfaced as missing.

🌟 New Features

• InterfaceId.REPLAY — on-device capture-replay transport. A debug/test-only "Demo Mode (Replay)" connection entry replays a pre-captured FromRadio frame stream entirely on-device — no network, no paired radio. It honours the two-phase want_config handshake (config → node DB → packet stream) and paces packets at a steady rate, giving a deterministic, self-contained traffic source for benchmarks, populated-UI tests, and manual QA. When the (gitignored) capture asset is absent it falls back to the existing synthetic MockRadioTransport, so the entry always works.

🛠️ Refactoring & Architecture

• Hardened the replay interface. The asset parser now validates every frame length against the bytes remaining and fails fast with IllegalArgumentException instead of an okio underflow or an oversized allocation; handleSendToRadio tolerates arbitrary inbound bytes (undecodable ToRadio is dropped, not thrown). The on-wire asset format is documented authoritatively in the ReplayRadioTransport KDoc.

🐛 Bug Fixes

• Isolate per-packet failures in the receive pipeline. The FromRadio decode boundary was already guarded, but the post-decode handler chain (processFromRadio → the per-variant handlers) and the orchestrator's receive loop (receivedData.onEach { handleFromRadio }) were not. A single malformed-but-decodable packet from any peer in radio range whose handler threw would cancel the receivedData collection and silently deafen the radio for the rest of the session — a remote DoS, and likely a crash on Android's default coroutine exception handler. Both layers now contain handler failures with safeCatching (which re-throws CancellationException, preserving structured concurrency), logging and dropping the offending packet.

Testing Performed

• ReplayFuzz + ReplayFuzzTest (new, core:network commonTest): a seeded, deterministic fuzz harness over the ingestion boundary (random / mutated / structurally-valid-but-hostile inputs), asserting four invariants — corrupt assets fail only with IllegalArgumentException; handleSendToRadio never throws; a bit-flipped frame decodes to a catchable Exception, never an Error; adversarial-but-valid content replays intact. Runs under allTests at zero app-size cost, and every failure reproduces from its integer seed.
• ReplayRadioTransportTest (extended): added malformed-asset cases (truncated counts, oversized lengths, short/empty sections) alongside the handshake/stream tests — 9 total.
• MeshMessageProcessorImplTest (extended): added a throwing handler does not propagate out of handleFromRadio, which forces a downstream handler to throw and asserts the call returns normally — it fails without the fix above.
• Full local gate green on the current main (detekt 2.0.0-alpha.5): spotlessCheck detekt assembleGoogleDebug kmpSmokeCompile, plus :core:network, :core:data, and :core:service allTests.
• The replay transport itself was verified on-device in earlier work: the two-phase handshake completes, a ~200-node DB lands, and packets decode through the normal ingestion pipeline.

The capture asset (burningmesh.fromradio) is derived from a private mesh capture and is gitignored — it is never committed. Without it, the "Demo Mode (Replay)" entry runs against the synthetic 2-node mock.