Close the final re-grade findings: parked EOSE fallback, panic atomicity, overflow visibility

EOSE callbacks parked while Tor is bootstrapping now get a fallback
unblock at the standard 10s EOSE timeout (via the injected scheduler,
generation-guarded, single-fire) instead of waiting up to ~225s for
Tor-readiness retry exhaustion. The identity swap in
refreshPeerIdentity runs inside a messageQueue barrier with re-entrancy
guard, so a panic reset can no longer race in-flight packet builds
(deadlock analysis documented; both call paths verified off-queue).
Relay send-queue overflow drops now log a sampled warning.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bitchatTests/BLEServiceCoreTests.swift

@@ -164,6 +164,23 @@ struct BLEServiceCoreTests {
         #expect(!ble._test_recordIngressIfNew(packet: packet, linkID: "central-b"))
     }
 
+    @Test
+    func panicReset_rotatesPeerIDDerivedFromNewNoiseFingerprint() async throws {
+        let ble = makeService()
+        let originalPeerID = ble.myPeerID
+        let originalFingerprint = ble.noiseIdentityFingerprint()
+        #expect(originalPeerID == PeerID(str: originalFingerprint.prefix(16)))
+
+        ble.resetIdentityForPanic(currentNickname: "anon")
+
+        // The Noise identity is regenerated and the peer ID swaps with it
+        // (atomically, behind a messageQueue barrier).
+        let newFingerprint = ble.noiseIdentityFingerprint()
+        #expect(newFingerprint != originalFingerprint)
+        #expect(ble.myPeerID != originalPeerID)
+        #expect(ble.myPeerID == PeerID(str: newFingerprint.prefix(16)))
+    }
+
     @Test
     func modifiedServices_rediscoverWhenBitChatServiceIsInvalidated() async throws {
         let otherService = CBUUID(string: "0000180F-0000-1000-8000-00805F9B34FB")