fix(nests): pin the interop harness's moq-relay to the version moq-auth expects

The local Docker interop stack builds moq-relay from a `./moq` checkout
that NostrNestsHarness cloned at unpinned `main` (~0.10.25+), while
nostrnests's moq-auth sidecar mints tokens for moq-relay 0.10.10 — the
version nostrnests pins in their own nests-relay/Dockerfile.relay. The
JWKS/JWT-signature handling drifted across those releases, so the relay
rejected every connection with `failed to decode the token` even though
the QUIC/TLS/WebTransport handshake completed cleanly.

Pin DEFAULT_MOQ_REVISION to the moq-relay-v0.10.10 release tag so the
harness builds the relay moq-auth was written against, and fetch tags so
the tag is checkout-able on a pre-existing clone.

https://claude.ai/code/session_01PoQupfdoKU3ryQwLwTeXeM

nestsClient/src/jvmTest/kotlin/com/vitorpamplona/nestsclient/interop/NostrNestsHarness.kt

@@ -99,12 +99,23 @@ class NostrNestsHarness private constructor(
         private const val MOQ_REPO_URL = "https://github.com/kixelated/moq.git"
 
         /**
-         * Pin the upstream `kixelated/moq` revision so test runs are
+         * Pin the upstream `kixelated/moq` revision the harness builds
-         * reproducible even if upstream main changes a wire-level detail
+         * `moq-relay` from. This MUST match the version nostrnests's
-         * we depend on (e.g. moq-lite framing). Override at runtime via
+         * `moq-auth` sidecar mints tokens for — otherwise the relay
-         * `-DnestsInteropMoqRev=<sha-or-branch>`.
+         * rejects every connection with `failed to decode the token`
+         * (the JWKS / JWT-signature handling drifted across releases).
+         *
+         * nostrnests pins `moq-relay --version 0.10.10` in their own
+         * `nests-relay/Dockerfile.relay`, so 0.10.10 is the version their
+         * `moq-auth` is written against. The `docker-compose-moq.yml` this
+         * harness uses builds `moq-relay` from `./moq` source instead of
+         * `cargo install`ing it, so we have to check out the matching tag
+         * ourselves. Plain `main` builds whatever is latest (0.10.25+),
+         * which moq-auth's tokens no longer satisfy.
+         *
+         * Override at runtime via `-DnestsInteropMoqRev=<sha-or-tag>`.
          */
-        const val DEFAULT_MOQ_REVISION = "main"
+        const val DEFAULT_MOQ_REVISION = "moq-relay-v0.10.10"
 
         private const val COMPOSE_FILE = "docker-compose-moq.yml"
         private const val PORT_READY_TIMEOUT_MS = 90_000L
@@ -314,8 +325,10 @@ class NostrNestsHarness private constructor(
             if (!moqDir.exists()) {
                 runProcess(nestsRepo, "git", "clone", MOQ_REPO_URL, "moq")
             }
-            // Reproducible runs: pin to the requested revision.
+            // Reproducible runs: pin to the requested revision. `--tags` so a
-            runProcess(moqDir, "git", "fetch", "origin", "--quiet")
+            // release-tag pin like `moq-relay-v0.10.10` is checkout-able even
+            // on a repo first cloned before that tag existed.
+            runProcess(moqDir, "git", "fetch", "origin", "--tags", "--quiet")
             runProcess(moqDir, "git", "checkout", "--quiet", rev)
         }