v0.6.2: Mythos Validation — full-codebase polish, hot-path optimizations, dhcproto 0.15

Codebase-wide review pass: finish or remove every loose end, take the
safe performance wins on the serving hot paths, and refresh the
dependency tree for reliability. No behavior changes for working
clients; legacy clients get clearer protocol errors.

Finalize / cleanup:
- Remove mac_allowlist/subnet_allowlist config fields — parsed but never
  enforced since introduction; the operator wants line-of-sight serving,
  so the honest fix is deletion, not wiring.
- Remove dead ClientRegistry API (get, set_selected_target,
  always-None selected_target field, never-emitted DhcpRequest/
  HttpIsoAsset events).
- TFTP: reject WRQ with ERR_ILLEGAL_OP and non-octet modes with a clear
  error instead of silent timeouts (legacy-client friendliness); fold
  plan_window into cfg(test); drop the unused-constant keep-alive hack.
- rustfmt sweep over the six files with accumulated drift.

Hot-path optimizations (all behavior-preserving):
- Serve embedded iPXE binaries zero-copy (Cow over rodata) on both TFTP
  and HTTP — was a ~1 MiB heap copy per boot file request.
- Cache the composited PXE boot-menu background PNG keyed on the
  branding logo revision — was ~50-200 ms of image work per booting
  client; now one compose per logo change.
- Run bcrypt verify/hash on the blocking pool (boot password gate,
  login, setup, credential rotation) so CPU-heavy auth can't stall the
  workers streaming ISO ranges to imaging machines.
- iso_raw: reuse the already-cloned IsoMeta for path resolution instead
  of a second registry lock + deep clone per range request.
- DriverEscalation: amortize the TTL sweep (1-min interval + inline
  staleness check) instead of an O(map) retain per DHCP packet.
- format_mac: one allocation instead of four per datagram.
- Introspection haystack sized to min(scan cap, file size) — was
  guaranteed a 32 MiB realloc on every large-ISO probe.

Robustness:
- parse_range: malformed Range headers are now ignored per RFC 7233
  (200 + full body) instead of answered with a bogus 206.

Dependencies:
- dhcproto 0.12 -> 0.15: drops the deprecated/unmaintained
  trust-dns-proto from the tree (hickory-proto), three releases of DHCP
  option coverage. Compiles + passes the full suite unchanged.
- socket2 0.6 (dedupes tree), bcrypt 0.19, tower-http 0.6.11 (sheds
  iri-string), tokio 1.52.3 / hyper 1.10 lockfile refresh; dead nom
  workspace entry removed; requested versions synced to shipped reality.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/dhcp-proxy/src/escalation.rs

@@ -35,6 +35,13 @@ const ENTRY_TTL: Duration = Duration::from_mins(30);
 /// entry — escalation is best-effort, never a memory-growth vector.
 const MAX_ENTRIES: usize = 4096;
 
+/// How often (at most) the whole map is swept for expired entries.
+/// Correctness doesn't depend on the sweep — a stale entry is also
+/// detected inline when its MAC next appears — so the sweep only bounds
+/// memory for MACs that never return, and amortizing it keeps the
+/// per-packet path O(1) instead of O(map).
+const PRUNE_INTERVAL: Duration = Duration::from_mins(1);
+
 #[derive(Debug, Clone, Copy)]
 struct Entry {
     mode: DriverMode,
@@ -45,10 +52,26 @@ struct Entry {
     last_seen: Instant,
 }
 
+#[derive(Debug)]
+struct Inner {
+    map: HashMap<String, Entry>,
+    /// When the last full TTL sweep ran — see [`PRUNE_INTERVAL`].
+    last_prune: Instant,
+}
+
+impl Default for Inner {
+    fn default() -> Self {
+        Self {
+            map: HashMap::new(),
+            last_prune: Instant::now(),
+        }
+    }
+}
+
 /// Tracks per-MAC driver-mode escalation. Cheap to share via `Arc`.
 #[derive(Debug, Default)]
 pub struct DriverEscalation {
-    inner: Mutex<HashMap<String, Entry>>,
+    inner: Mutex<Inner>,
 }
 
 impl DriverEscalation {
@@ -75,11 +98,23 @@ impl DriverEscalation {
 
     fn decide_at(&self, mac: &str, primary: bool, now: Instant) -> DriverMode {
         let mut g = self.inner.lock();
-        g.retain(|_, e| now.duration_since(e.last_seen) < ENTRY_TTL);
+        if now.duration_since(g.last_prune) >= PRUNE_INTERVAL {
+            g.map
+                .retain(|_, e| now.duration_since(e.last_seen) < ENTRY_TTL);
+            g.last_prune = now;
+        }
+        // Inline staleness check: a MAC whose entry outlived the TTL starts
+        // fresh even when the amortized sweep above hasn't caught it yet.
+        if g.map
+            .get(mac)
+            .is_some_and(|e| now.duration_since(e.last_seen) >= ENTRY_TTL)
+        {
+            g.map.remove(mac);
+        }
 
-        match g.get_mut(mac) {
+        match g.map.get_mut(mac) {
             None => {
-                g.insert(
+                g.map.insert(
                     mac.to_owned(),
                     Entry {
                         mode: DriverMode::Firmware,
@@ -88,8 +123,8 @@ impl DriverEscalation {
                         last_seen: now,
                     },
                 );
-                if g.len() > MAX_ENTRIES {
-                    evict_oldest(&mut g);
+                if g.map.len() > MAX_ENTRIES {
+                    evict_oldest(&mut g.map);
                 }
                 DriverMode::Firmware
             }
@@ -114,7 +149,7 @@ impl DriverEscalation {
 
     fn confirm_at(&self, mac: &str, now: Instant) {
         let mut g = self.inner.lock();
-        if let Some(e) = g.get_mut(mac) {
+        if let Some(e) = g.map.get_mut(mac) {
             e.awaiting_confirm = false;
             e.last_seen = now;
         }