spec(port): port the generation skip-window DoS defence (Refs #8884)

[dmitrii-f-t27]

Refs #8884 (CR-CHAT-04 ring tracker). Parent epic: gHashTag/trios#1812 (W2, own lane, T-PORT). Fifth W2 target delivered: the intra-epoch skip-distance cap of RFC 9420 9.3 — seven rules in the original's order (canonical sender-id length, known sender, active epoch, non-empty ciphertext, non-zero generation, strictly monotone generation, skip distance within the window), D5 verdict, all ten AMGSD tests transcribed plus helper and rule-order tests (14 total, 0 vacuous). The known-sender table is a one-dimensional array of records holding the fixed id — a two-dimensional fixed array is not lowered by the Rust backend (measured E0308), the record form is the conventions' own for fixed bytes. Records carry lengths and ids, not ciphertext bytes. t27b 14/14 native; t27c 14/14, 0 vacuous; gen-rust compiles under rustc; coverage Untested 0; seal all hashes MATCH; ledger row included (pass, 28/28 untouched). Dedup checked. Sequencing: one-line ledger rebase if #9614/#9641/#9650 land first — I take it on request.

[dmitrii-f-t27]

Merge request for the gHashTag merger: steward READY (required all SUCCESS; the red ones are non-required per Q16 and red on master too). Ledger row included; one-line rebase if #9614/#9641/#9650 land first — I take it on request.