No test exercises the TCP wire: add a real client-to-writer round-trip test

[Pendu]

Problem

TCPClient (src/traceml_ai/transport/tcp_transport.py:195) is never
constructed against a real socket in any test: exporter/publisher tests
substitute fakes, and the TCPServer tests only cover bind behavior, never
accepting and decoding a framed envelope. The msgpack framing tests verify a
test-side re-implementation of the writer framing rather than the production
writer. Malformed or version-skewed envelopes through the aggregator drain
path are also unpinned.

This means the actual product wire (4-byte length prefix + msgpack envelope,
client connect/send/reconnect, server accept/drain) has no automated coverage;
any framing or protocol regression only surfaces in a live run.

Proposal

One in-process integration test (real sockets on port 0, no subprocesses):

1. Start a real TCPServer, connect a real TCPClient, send a batch through
   the production sender path, drain it in the aggregator loop, and assert the
   projected SQLite rows.
2. Add malformed-envelope cases (truncated frame, missing meta keys, wrong
   types) and assert the drain path fails safe instead of crashing the loop.
3. Optionally a reconnect case: restart the server and assert the client
   re-establishes and continues.

[Pendu]

Scope extension from the 0.3.7 program review (tracking: #322),
two cases the round-trip as drafted would miss:

1. Old-version envelope decode. The round-trip covers the current
envelope over a healthy socket. Users in the wild run v0.2.x-0.3.1 clients
and backward compatibility is a stated constraint, so add: a captured (or
reconstructed) old-version payload decoded against the current aggregator,
asserting either correct ingestion or the documented reject path; never a
crash or silent misparse.

2. Backpressure vs the never-block-training guarantee. A stalled reader
(aggregator accepts, then stops draining) while the client keeps sending:
assert the training-side path drops/queues per its contract and never
blocks, and that the drop is observable (counter), not silent. This is the
best-effort contract at the socket layer, and nothing tests it today.