v0.6.3: split SessionState locking (Mutex -> RwLock), modeled on WireGuard

Third same-night follow-up in the lock-contention investigation. The
daemon-wide crypto session lock forced every encrypt call (11 sites:
Data, Probe replies, StatsShare, VersionInfo, ThroughputTest) to
serialize behind every other encrypt AND behind decrypt/install/
expire_previous, even though encrypt has always taken &self and only
genuinely needs shared access. Split into RwLock: encrypt uses
.read().await (concurrent with other encrypts now), decrypt/install/
expire_previous keep .write().await where exclusivity is actually
needed. Modeled on wireguard-go's real design (lock-free nonce atomic,
lock only guards which keypair is active). Independently reviewed
given the crypto-adjacent correctness stakes -- all 16 call sites
verified, concurrent-encrypt safety verified against the underlying
snow crate's cipher implementation, no torn reads possible during a
concurrent rekey install.