Initial commit: Naut-Torrent — from-scratch 10 GbE BitTorrent client

A maintainable, extensible BitTorrent client (C11, Linux/io_uring) targeting
10 GbE saturation. All torrent functionality is built from scratch; liburing
is the only linked third-party dependency on the data path.

Implements Phases 1-7 of the roadmap:
- core: page-aligned buffer pool, MPMC/Treiber queues, bitfields, worker pool
- crypto: SHA-1/256 (SHA-NI + scalar), Merkle (BEP-52), RC4 (MSE)
- bencode/metainfo: zero-copy parser, v1/v2/hybrid .torrent + magnet
- peer: sans-IO wire codec, MSE/PE handshake state machine, BEP-10, ut_metadata, PEX
- piece/storage: block-level multi-peer engine, rarest-first + endgame,
  per-file completion events + single-file relocate (move-as-you-finish)
- tracker/dht: HTTP + UDP (BEP-15) trackers, BEP-5 KRPC iterative lookup
- platform: io_uring reactor (SQPOLL, registered buffers, SEND_ZC)
- surface: versioned RPC, native plugin ABI, sandboxed Lua scripting, nautd/nautctl

Verified against libtorrent (single/multi/hybrid, MSE, magnet-via-DHT, swarm);
unit + interop tests green; ASan/UBSan/TSan clean. Scripting reference in
docs/scripting.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/integration/run_mse.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Phase 5 MSE gate: a libtorrent seed requires encrypted incoming connections.
+set -u
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+LEECH="${1:-$ROOT/build/naut_leech}"
+SEEDER="$ROOT/tests/integration/seeder.py"
+TORRENT="$ROOT/tests/fixtures/single_v1.torrent"
+DATA="$ROOT/tests/fixtures/data"
+
+python3 -c 'import libtorrent' 2>/dev/null || {
+  echo "SKIP: python libtorrent not available"; exit 77;
+}
+[ -x "$LEECH" ] || { echo "FAIL: $LEECH not built"; exit 1; }
+
+out="$(mktemp -d /tmp/naut_mse.XXXXXX)"
+log="$(mktemp /tmp/naut_mse_seed.XXXXXX)"
+client_log="$(mktemp /tmp/naut_mse_client.XXXXXX)"
+cleanup() {
+  [ -n "${seed:-}" ] && kill "$seed" 2>/dev/null || true
+  rm -rf "$out" "$log" "$client_log"
+}
+trap cleanup EXIT
+
+NAUT_FORCE_MSE=1 python3 "$SEEDER" "$TORRENT" "$DATA" > "$log" 2>&1 &
+seed=$!
+port=""
+for _ in $(seq 1 100); do
+  port=$(grep -oP 'PORT \K[0-9]+' "$log" 2>/dev/null)
+  [ -n "$port" ] && break
+  sleep 0.1
+done
+[ -n "$port" ] || { echo "FAIL: encrypted seeder did not start"; cat "$log"; exit 1; }
+
+if ! timeout 30 "$LEECH" --mse "$TORRENT" "$out" 127.0.0.1 "$port" \
+    >"$client_log" 2>&1; then
+  echo "FAIL: MSE download did not complete"
+  cat "$client_log"
+  cat "$log"
+  exit 1
+fi
+grep -q "COMPLETE" "$client_log" || {
+  echo "FAIL: client exited without completing"
+  cat "$client_log"
+  exit 1
+}
+diff -r "$out/single.bin" "$DATA/single.bin" >/dev/null || {
+  echo "FAIL: MSE content mismatch"; exit 1;
+}
+echo "PASS: forced MSE/RC4 download is byte-identical"