Move cert noise calibration into doppelganger scout

Instead of a separate cert_probe.go that duplicates the scout's TLS
connection logic, measure the cert chain size directly from the same
HTTPS connections the scout already makes.

Changes:
- Extend ScoutConnResult with payloadLen field
- Add Write interception to ScoutConn for handshake boundary detection
- Scout.learn() now computes cert size (sum of ApplicationData between
  CCS and first client Write) alongside inter-record durations
- Ganger aggregates cert sizes across raids and exposes NoiseParams()
  via atomic pointer for lock-free reads from proxy goroutines
- Proxy reads NoiseParams from Ganger on each handshake instead of
  probing at startup
- Remove cert_probe.go, disk cache, and related config options
  (noise-cache-path, noise-cache-ttl, noise-probe-count)

Falls back to legacy 2500-4700 range until the first scout raid
completes (typically within 1-2 seconds of startup).

internal/cli/run_proxy.go

@@ -267,10 +267,6 @@ func runProxy(conf *config.Config, version string) error { //nolint: funlen
 		DoppelGangerPerRaid: conf.Defense.Doppelganger.Repeats.Get(mtglib.DoppelGangerPerRaid),
 		DoppelGangerEach:    conf.Defense.Doppelganger.UpdateEach.Get(mtglib.DoppelGangerEach),
 		DoppelGangerDRS:     conf.Defense.Doppelganger.DRS.Get(false),
-
-		NoiseProbeCount: conf.Defense.Doppelganger.NoiseProbeCount.Get(0),
-		NoiseCacheTTL:   conf.Defense.Doppelganger.NoiseCacheTTL.Get(0),
-		NoiseCachePath:  conf.Defense.Doppelganger.NoiseCachePath,
 	}
 
 	proxy, err := mtglib.NewProxy(opts)

internal/config/config.go

@@ -54,9 +54,6 @@ type Config struct {
 			Repeats         TypeConcurrency `json:"repeats_per_raid"`
 			UpdateEach      TypeDuration    `json:"raid_each"`
 			DRS             TypeBool        `json:"drs"`
-			NoiseProbeCount TypeConcurrency `json:"noise_probe_count"`
-			NoiseCacheTTL   TypeDuration    `json:"noise_cache_ttl"`
-			NoiseCachePath  string          `json:"noise_cache_path"`
 		} `json:"doppelganger"`
 	} `json:"defense"`
 	Network struct {

internal/config/parse.go

@@ -49,9 +49,6 @@ type tomlConfig struct {
 			Repeats         uint     `toml:"repeats-per-raid" json:"repeats_per_raid,omitempty"`
 			UpdateEach      string   `toml:"raid-each" json:"raid_each,omitempty"`
 			DRS             bool     `toml:"drs" json:"drs,omitempty"`
-			NoiseProbeCount uint     `toml:"noise-probe-count" json:"noise_probe_count,omitempty"`
-			NoiseCacheTTL   string   `toml:"noise-cache-ttl" json:"noise_cache_ttl,omitempty"`
-			NoiseCachePath  string   `toml:"noise-cache-path" json:"noise_cache_path,omitempty"`
 		} `toml:"doppelganger" json:"doppelganger,omitempty"`
 	} `toml:"defense" json:"defense,omitempty"`
 	Network struct {