fix: Phase 8 — mesh hardening: atomic writes, unwrap elimination, GPS opt-out

- Ratchet state: atomic write via tmp + rename to prevent corruption on crash
- Block header decode: replaced .unwrap() with proper error handling on
  untrusted network data (was a crash vector from malicious peers)
- Shutdown channel: replaced .unwrap() with .ok_or_else() error propagation
- Dead man's switch GPS: default changed to opt-out (auto_include_gps=false)
- Alert signature verification: already covered by Phase 4 envelope checks

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/mesh/mod.rs

@@ -235,7 +235,8 @@ impl MeshService {
         let dms = Arc::clone(&self.dead_man_switch);
         let dms_state = Arc::clone(&self.state);
         let dms_key = self.signing_key.clone();
-        let dms_shutdown = self.shutdown_tx.as_ref().unwrap().subscribe();
+        let dms_shutdown = self.shutdown_tx.as_ref()
+            .ok_or_else(|| anyhow::anyhow!("Shutdown channel not initialized"))?.subscribe();
         let dms_handle = tokio::spawn(async move {
             let mut shutdown = dms_shutdown;
             let mut interval = tokio::time::interval(Duration::from_secs(60));
@@ -275,7 +276,8 @@ impl MeshService {
             let bha_cache = Arc::clone(&self.block_header_cache);
             let bha_key = self.signing_key.clone();
             let bha_did = self.our_did.clone();
-            let bha_shutdown = self.shutdown_tx.as_ref().unwrap().subscribe();
+            let bha_shutdown = self.shutdown_tx.as_ref()
+                .ok_or_else(|| anyhow::anyhow!("Shutdown channel not initialized"))?.subscribe();
             let bha_handle = tokio::spawn(async move {
                 let mut shutdown = bha_shutdown;
                 let mut interval = tokio::time::interval(Duration::from_secs(30));