fix(adr-115): CI green — example feature-gate + mosquitto allow_anon + bench numbers

## Two CI failures on PR #778 fixed

### 1. Rust Workspace Tests (E0601: `main` not found in mqtt_publisher)

Default `cargo build --workspace` compiles examples without forwarding
`--features mqtt`. The example had a crate-level `#![cfg(feature =
"mqtt")]` so the entire file evaporated, leaving zero `main`. Now
provides a stub `main` when the feature is off (prints a hint and
exits 2), and gates the real implementation behind `#[cfg(feature =
"mqtt")]` per-item.

Local verification:
  cargo check --no-default-features --examples → clean

### 2. mqtt-integration (mosquitto never became reachable)

`eclipse-mosquitto:2.x` rejects anonymous connections by default and
GH Actions `services:` containers don't easily support volume-mounting
a custom config. Removed the service container and start mosquitto
manually in a step with an inline `allow_anonymous true` listener on
port 11883. Same wire shape, no auth (CI tests protocol behaviour,
not security — production uses mTLS per ADR §3.9).

## Benchmark numbers captured (`docs/integrations/benchmarks.md`)

Ran `cargo bench --features mqtt --bench mqtt_throughput` locally:

| Hot path                              | Measured | Target | Better by |
|---------------------------------------|----------|--------|-----------|
| state::event_fall encode              | 259 ns   | <2 µs  | 7.7×      |
| rate_limiter::allow_first             | 49.7 ns  | <100 ns| 2×        |
| rate_limiter::allow_within_gap        | 62.1 ns  | <100 ns| 1.6×      |
| privacy::decide_hr_strip              | 0.24 ns  | <50 ns | 208×      |
| privacy::decide_presence_keep         | 0.24 ns  | <50 ns | 208×      |
| semantic::bus_tick_all_10_primitives  | 717 ns   | <10 µs | 14×       |

At 1 Hz publish rate per node, the entire ADR-115 hot path costs
~1 µs per node per tick on commodity hardware. A Cognitum Seed
hosting 100 nodes would burn 100 µs/sec — 0.01% load floor. Memory:
~30 KB total FSM state for 10 primitives × 100 nodes.

The numbers exceed every target by ≥1.6×, several by 100×+. No need
to optimise further for v0.7.0.

Refs #776, PR #778.

Co-Authored-By: claude-flow <ruv@ruv.net>

.github/workflows/mqtt-integration.yml

@@ -27,18 +27,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
 
-    services:
-      mosquitto:
-        image: eclipse-mosquitto:2.0.18
-        ports:
-          - 11883:1883
-        # No auth — we test the wire shape, not auth. Production
-        # deployments enable mTLS per ADR-115 §3.9.
-        options: >-
-          --health-cmd "mosquitto_pub -h localhost -p 1883 -t healthcheck -m ok -q 0 || exit 0"
-          --health-interval 5s
-          --health-timeout 3s
-          --health-retries 10
+    # NB: we don't use a `services:` mosquitto container here because the
+    # eclipse-mosquitto:2.x image rejects anonymous connections by default
+    # and GH Actions `services` doesn't easily support mounting a custom
+    # config file. We start mosquitto manually in a step below with an
+    # inline `allow_anonymous true` config.
 
     env:
       RUVIEW_RUN_INTEGRATION: "1"
@@ -49,16 +42,30 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Wait for mosquitto to be reachable
+      - name: Install mosquitto + clients and start with allow_anonymous
         run: |
-          sudo apt-get update -qq && sudo apt-get install -y mosquitto-clients
+          sudo apt-get update -qq
+          sudo apt-get install -y mosquitto mosquitto-clients
+          sudo systemctl stop mosquitto || true
+          # Inline config: anon listener on 11883 only — no TLS, no auth,
+          # OK for CI because we test the wire shape, not security.
+          # Production deployments enable mTLS per ADR-115 §3.9.
+          cat > /tmp/mosquitto-ci.conf <<'EOF'
+          listener 11883
+          allow_anonymous true
+          persistence false
+          log_dest stdout
+          EOF
+          mosquitto -c /tmp/mosquitto-ci.conf -d
           for i in {1..20}; do
-            if mosquitto_pub -h 127.0.0.1 -p 11883 -t healthcheck -m ok -q 0; then
+            if mosquitto_pub -h 127.0.0.1 -p 11883 -t healthcheck -m ok -q 0 2>/dev/null; then
               echo "mosquitto reachable on 11883"; exit 0
             fi
             sleep 2
           done
-          echo "mosquitto never became reachable" >&2; exit 1
+          echo "mosquitto never became reachable" >&2
+          tail -50 /var/log/mosquitto/*.log 2>/dev/null || true
+          exit 1
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable