Fix StreamBus release blockers #83

Follow-up for #77 after the merged main run failed EUProvGuard and review found two transport gaps.

Scope:

• bump golang.org/x/crypto past CVE-2026-78662 and CVE-2026-56855.
• keep StreamBus outbound delivery from consuming SSC sequence numbers when transport delivery cannot accept the frame.
• remove the redundant Warp replay journal for per-connection StreamBus topics.

Out of scope:

• a full HTTP/3 lifecycle/configuration API.
• broader end-to-end StreamBus compatibility coverage.

Those are release-hardening follow-ups, not evidence that #77 merged with failing PR checks.