test(private-relay): refuse tampered PAGE head and count

[0thernet]

Change

• On the existing 15+1 byte-capped PAGE fixture, flip head below the last record or to the apparent completed cursor, and count below/above the 15 encoded records or beyond the page limit. Every mutation must return NetError::Malformed; the unchanged continuation still recovers all 16 items in mailbox order.
• Only crates/vhalla-private-relay/src/wire_tests.rs changes. No decoder, wire budget, dependency, or durable-state behavior changes.

Verification (Darwin, Rust 1.98.1, locked/offline Cargo)

• Exact focused wire_tests::byte_cap_pages_keep_mailbox_positions_and_reject_corrupt_continuations: 1/1.
• cargo test -p vhalla-private-relay: 6/6 and doc tests.
• cargo check -p vhalla-private-relay --target wasm32-unknown-unknown, strict all-target/all-feature package Clippy, cargo fmt --all -- --check, and staged git diff --check: passed.
• Final integration gate: this PR's exact-head Required and post-merge main Required; not yet claimed.

Agent-decided, owner may revisit (2026-10-11): retain production PAGE semantics and add explicit malformed-field refusal fixtures rather than changing the codec or its bounds. This is a portable codec regression, not browser execution, independent-machine qualification, live delivery, physical-crash recovery, or release readiness. No herd-live request is appropriate for this source-only test.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
valhalla	Ready	Preview	Oct 11, 2026 1:15pm UTC