Implement and verify CONNECT-IP MTU and ICMPv6 behavior #982

Parent: #970

Deliverable

Correct packet-size handling and ICMPv6 signaling across the connector tunnel and gVPC forwarding path, with reproducible path-MTU tests.

Dependencies

#980, #981

Galactic Edge integration (#992)

Implement this milestone as a consumer of the Galactic Edge provider contract. #992 owns provider authorization, host attachment lifecycle, shared-state fencing and maintenance, independently enforced forwarding expiry, prefix conflict arbitration/publication, and gVPC traffic policy. MASQUE owns client authentication, connector /96 assignment and retention, session packet checks, transport behavior and its provider adapter. Use the foundation's versioned contract and existing provider helpers; do not introduce a second host-networking controller, lease store or BGP publisher. Any required foundation change must be tracked and qualified under #992 before this milestone claims integrated acceptance.

Work

• Account for actual QUIC datagram capacity and framing overhead when admitting and forwarding inner IPv6 packets.
• Implement correct Packet Too Big behavior for oversized packets and explicit tunnel failure when the QUIC path cannot support the required IPv6 minimum, following RFC 9484.
• Exercise the complete path, including return traffic and gVPC encapsulation/decapsulation; fix any packet-size handling gap that prevents acceptance.
• Validate HTTP/2 capsule reassembly across transport segments without imposing the QUIC single-datagram size limit. Maintain configured resource bounds.

Acceptance criteria

• Both transports pass bidirectional 1280-byte inner IPv6 delivery against real workloads.
• Controlled path-MTU reductions during an active QUIC tunnel produce correct ICMPv6 feedback or required tunnel termination, not silent black holes.
• Packets larger than the usable tunnel or downstream MTU exercise the appropriate error path; feedback reaches the correct connector and obeys policy.
• Tests record inner packet size, outer path MTU and observed behavior and cover local and remote workload paths.

Additional integration acceptance

• Record attachment/device MTU, SRv6/underlay overhead and transport payload capacity independently; coordinate any host-side correction with the foundation rather than granting MASQUE host privileges.
• Resolve Edge pod attachments: unchecked caller inputs and weak isolation tests #989's attachment-MTU-ceiling finding with a linked fix or current-path proof. Device drift/readback and insufficient underlay capacity must produce explicit behavior.
• Include local-NAT-egress and remote-workload paths, both directions, live MTU changes, control-packet policy and tenant-safe feedback. PacketAccess readiness alone is not MTU acceptance.

Scope follows #970: CONNECT-IP with HTTP/2 fallback; no public API development, plugin/portal integration, product-client development or production rollout.