fix: Phase 8 — mesh hardening: atomic writes, unwrap elimination, GPS opt-out

- Ratchet state: atomic write via tmp + rename to prevent corruption on crash
- Block header decode: replaced .unwrap() with proper error handling on
  untrusted network data (was a crash vector from malicious peers)
- Shutdown channel: replaced .unwrap() with .ok_or_else() error propagation
- Dead man's switch GPS: default changed to opt-out (auto_include_gps=false)
- Alert signature verification: already covered by Phase 4 envelope checks

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/mesh/bitcoin_relay.rs

@@ -237,9 +237,11 @@ pub fn decode_compact_block_header(payload: &[u8]) -> Result<(u64, String, u32)>
     if payload.len() < 44 {
         anyhow::bail!("Compact block header too short: {} bytes", payload.len());
     }
-    let height = u64::from_le_bytes(payload[0..8].try_into().unwrap());
+    let height = u64::from_le_bytes(payload[0..8].try_into()
+        .map_err(|_| anyhow::anyhow!("Invalid height bytes in block header"))?);
     let hash_hex = hex::encode(&payload[8..40]);
-    let timestamp = u32::from_le_bytes(payload[40..44].try_into().unwrap());
+    let timestamp = u32::from_le_bytes(payload[40..44].try_into()
+        .map_err(|_| anyhow::anyhow!("Invalid timestamp bytes in block header"))?);
     Ok((height, hash_hex, timestamp))
 }