v0.6.3: split SessionState locking (Mutex -> RwLock), modeled on WireGuard Third same-night follow-up in the lock-contention investigation. The daemon-wide crypto session lock forced every encrypt call (11 sites: Data, Probe replies, StatsShare, VersionInfo, ThroughputTest) to serialize behind every other encrypt AND behind decrypt/install/ expire_previous, even though encrypt has always taken &self and only genuinely needs shared access. Split into RwLock: encrypt uses .read().await (concurrent with other encrypts now), decrypt/install/ expire_previous keep .write().await where exclusivity is actually needed. Modeled on wireguard-go's real design (lock-free nonce atomic, lock only guards which keypair is active). Independently reviewed given the crypto-adjacent correctness stakes -- all 16 call sites verified, concurrent-encrypt safety verified against the underlying snow crate's cipher implementation, no torn reads possible during a concurrent rekey install.