Move cert noise calibration into doppelganger scout

Instead of a separate cert_probe.go that duplicates the scout's TLS
connection logic, measure the cert chain size directly from the same
HTTPS connections the scout already makes.

Changes:
- Extend ScoutConnResult with payloadLen field
- Add Write interception to ScoutConn for handshake boundary detection
- Scout.learn() now computes cert size (sum of ApplicationData between
  CCS and first client Write) alongside inter-record durations
- Ganger aggregates cert sizes across raids and exposes NoiseParams()
  via atomic pointer for lock-free reads from proxy goroutines
- Proxy reads NoiseParams from Ganger on each handshake instead of
  probing at startup
- Remove cert_probe.go, disk cache, and related config options
  (noise-cache-path, noise-cache-ttl, noise-probe-count)

Falls back to legacy 2500-4700 range until the first scout raid
completes (typically within 1-2 seconds of startup).

mtglib/proxy_opts.go

@@ -161,24 +161,6 @@ type ProxyOpts struct {
 	// DoppelGangerDRS defines if TLS Dynamic Record Sizing is active.
 	DoppelGangerDRS bool
 
-	// NoiseProbeCount is the number of TLS connections to make when probing
-	// the fronting domain's cert chain size for noise calibration.
-	// Default is 15.
-	//
-	// This is an optional setting.
-	NoiseProbeCount uint
-
-	// NoiseCacheTTL is how long a cached cert probe result is considered
-	// valid. Default is 24 hours.
-	//
-	// This is an optional setting.
-	NoiseCacheTTL time.Duration
-
-	// NoiseCachePath is the file path for caching cert probe results
-	// between restarts. If empty, no caching is performed.
-	//
-	// This is an optional setting.
-	NoiseCachePath string
 }
 
 func (p ProxyOpts) valid() error {