feat: wire-codec — UDP datagram framing (frame_datagram/DatagramReader)

- [len: u16 BE] per-datagram framing per ADR-003; len=0 is a legal
  empty datagram (F-2 invariant), never EOF
- DatagramCodecError: Oversize (frame-time, never a wire overflow) +
  InvalidLength (truncated stream — the OQ-TN-13 fail-loud codec-side
  anchor)
- DatagramReader: incremental decoder — datagrams split across chunks,
  batched in one chunk, partial headers; feed -> Vec<Bytes> (zero-copy
  freeze handoff)
- is_mid_datagram teardown diagnostic
- 8 test families pinning the ADR-003/BAST invariants incl. 7-byte
  chunk splits and truncated-stream-never-yields-partial

Verified: cargo test (14 passed), clippy --all-targets -D warnings
(native + wasm32), fmt --check, wasm32 check — all clean

tasks/tunnels/wire-codec.md

@@ -1,7 +1,7 @@
 ---
 id: tunnels/wire-codec
 name: Data-plane codec (frame_datagram / DatagramReader) + sentinel layering tests
-status: pending
+status: completed
 depends_on: [tunnels/crate-init, tunnels/params]
 scope: narrow
 risk: medium
@@ -65,13 +65,13 @@ the POC proved no collision).
 
 ## Acceptance Criteria
 
-- [ ] All 8 test families above pass (the POC's 7 + the truncation pin)
-- [ ] `frame_datagram` returns `Bytes` (zero-copy handoff to the mux)
-- [ ] `DatagramReader` state is incremental across arbitrary chunk
+- [x] All 8 test families above pass (the POC's 7 + the truncation pin)
+- [x] `frame_datagram` returns `Bytes` (zero-copy handoff to the mux)
+- [x] `DatagramReader` state is incremental across arbitrary chunk
       boundaries
-- [ ] `cargo clippy --all-targets -- -D warnings`, `cargo fmt --check`
+- [x] `cargo clippy --all-targets -- -D warnings`, `cargo fmt --check`
       clean
-- [ ] wasm32 check passes (the codec is pure byte work — it must be
+- [x] wasm32 check passes (the codec is pure byte work — it must be
       wasm-clean)
 
 ## References
@@ -84,8 +84,36 @@ the POC proved no collision).
 
 ## Notes
 
-> Agent fills during implementation.
+- Direct port of the POC's wire.rs (17 tests rode it) with the crate
+  conventions: thiserror doc comments, module doc per ADR-003 +
+  wire.md + bast.md layering (sentinel layering called out — the F-2
+  invariant is load-bearing, so the module doc states why raw
+  pass-through is structurally broken for UDP).
+- Error naming per the task's API: `Oversize(usize, usize)` (was
+  POC's `TooLarge`) + `InvalidLength {declared, have}` (the
+  truncated-stream shape — the OQ-TN-13 fail-loud posture's codec-side
+  anchor).
+- `feed` returns `Vec<Bytes>` per the task API (the POC's
+  `Vec<Datagram>` wrapper dropped — `Bytes` is the payload; the mux
+  handoff is zero-copy via `BytesMut::freeze`).
+- `MAX_DATAGRAM_LEN`/`DATAGRAM_LEN_FIELD` constants; `DATAGRAM_LEN_FIELD`
+  is private (implementation detail), `MAX_DATAGRAM_LEN` public (the
+  frame-time bound consumers need).
+- 8 test families: single round-trip, empty-datagram-not-EOF,
+  7-byte-chunk split reassembly, two-datagram batch, partial header,
+  mid-datagram observability, oversize at frame time, truncated
+  stream (feeds an empty chunk + a one-byte-short tail — never yields
+  a partial datagram; the codec-side half of OQ-TN-13; the
+  adapter-level receive shape lands with local-socket-halves).
+- POC's `Datagram` struct dropped: `Bytes` suffices (the task's
+  `feed -> Vec<Bytes>` signature); `is_empty()` moves to callers
+  (trivial on `Bytes`).
 
 ## Summary
 
-> Agent fills this on completion.
+`src/wire.rs` complete: `frame_datagram` (Oversize at frame time,
+`len=0` legal), `DatagramReader` (incremental decoder, `is_mid_datagram`
+teardown diagnostic), `DatagramCodecError {Oversize, InvalidLength}` —
+the ADR-003/BAST contract in executable form. 8 codec tests + 6 params
+tests = 14 passing. Verified: cargo test, clippy --all-targets -D
+warnings (native + wasm32), fmt --check, wasm32 check — all clean.