feat(nests): T16 Phase 1 — cross-stack interop harness scaffolding

Lands the load-bearing infra for the hang/Rust cross-stack interop
test plan (nestsClient/plans/2026-05-06-cross-stack-interop-test.md):
the cargo workspace, Gradle wiring to install moq-relay /
moq-token-cli + build sidecars, the Kotlin harness that boots a
real moq-relay subprocess on a random ephemeral UDP port with
self-signed TLS and unrestricted public auth, plus the signal-domain
PCM assertion library and deterministic sine-wave AudioCapture that
Phase 2 scenarios will assert against.

Phase-1 deviations from the spec are summarised in
nestsClient/plans/2026-05-06-cross-stack-interop-test-results.md
— notably: --auth-public "" instead of the JWT minter (no
security-relevant difference for wire-format scenarios), --tls-generate
instead of in-Kotlin cert generation, cargo-install of upstream
binaries instead of an embedded kixelated/moq checkout, and
hang-listen / hang-publish / udp-loss-shim shipped as Phase-1 stubs
that compile + accept --flags but do nothing. Phase 2 fills those
in (and adds JVM Opus encoder/decoder).

Verified green via:
  ./gradlew :nestsClient:jvmTest \
      --tests "com.vitorpamplona.nestsclient.interop.native.*" \
      --tests "com.vitorpamplona.nestsclient.audio.PcmAssertionsTest" \
      -DnestsHangInterop=true

Default mode (no flag) cleanly skips the harness-dependent test.

https://claude.ai/code/session_01ERJPUYfdLPwZ99pr5EcEcV

cli/hang-interop/hang-publish/src/main.rs

@@ -0,0 +1,36 @@
+//! hang-publish — reference moq-lite / hang audio publisher for the
+//! cross-stack interop harness. **Phase 1 stub.**
+
+use anyhow::Result;
+use clap::Parser;
+
+#[derive(Parser, Debug)]
+#[command(
+    name = "hang-publish",
+    about = "Reference moq-lite / hang audio publisher (Phase 1 stub)"
+)]
+struct Args {
+    #[arg(long)]
+    relay_url: String,
+    #[arg(long)]
+    jwt: Option<String>,
+    #[arg(long)]
+    broadcast: String,
+    #[arg(long, default_value_t = 440)]
+    freq_hz: u32,
+    #[arg(long, default_value_t = 5)]
+    duration: u64,
+    #[arg(long, default_value_t = 1)]
+    channels: u32,
+}
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    let args = Args::parse();
+    eprintln!(
+        "hang-publish Phase-1 stub — relay_url={} broadcast={} freq_hz={} duration={}s channels={}",
+        args.relay_url, args.broadcast, args.freq_hz, args.duration, args.channels
+    );
+    eprintln!("Phase 2 will implement the actual publish loop. Exiting cleanly.");
+    Ok(())
+}