feat: adopt dig-logging for real retrievable node logs (#553)

[MichaelTaylor3d]

Closes the dig-node side of DIG-Network/dig_ecosystem#553.

What changed

Before this PR, dig_node_core + its P2P/TLS stack emitted tracing events but dig-node-service installed no subscriber — every event was silently dropped and a Windows-service run produced no log at all. This adopts the shared dig-logging crate (crates.io ^0.1):

• Subscriber install at the SERVE entrypoints only — entrypoint::block_on_serve (foreground run / unix daemon) and win_service::run_service (the Windows service body, which has no console). One-shot CLI commands do not install it. The LogGuard lives in a process-global OnceLock (logging.rs) since tracing has one global subscriber per process and the guard must outlive the process; this also gives control.log.setLevel the reload handle without threading it through serve.
• eprintln! → tracing migration across every serve-path site, each at the level matching its MEANING with structured fields (never string-concat).
• control.log.setLevel — new gated control method that live-swaps the level filter via the dig-logging reload handle (immediate, not persisted).
• dig-node logs … verbs — mounts dig-logging's shared path|tail|level|bundle subcommand. logs level <filter> persists AND best-effort live-applies to a running node via control.log.setLevel.
• Never-log guarantee (SPEC §7) — per-request logging is routed through logging::log_rpc_dispatch(method), which by signature can only see the method name, never params (which carry tokens). tests/never_log.rs locks this in.
• SPEC.md §20 (logging surface, dirs per OS, verbs, levels, never-log) + §7.4 (control.log.setLevel row); DEVELOPMENT_LOG realization added.

Log-level distribution (26 migrated sites)

• error! ×1 — Windows service body exited with an error.
• warn! ×15 — control-token persist/secure fallbacks (×3), mTLS listener bind/exit, IPv6-loopback + dig.local bind failures, TLS root not privileged / leaf load failure / CA renewal due / renewal pass failed/incomplete, HTTPS bind/exit.
• info! ×7 — node listening (addrs+upstream), mTLS listening, dig.local enabled, HTTPS listening, leaf renewed, no-leaf-yet (expected), shutting down.
• debug! ×3 — per-request rpc dispatch (op_id-correlated), self-heal per-tick pass ×2, dig.local disabled-by-config.

entrypoint.rs/service.rs CLI-error/install-warning eprintln!s are deliberately KEPT (operator console UX for one-shot commands that install no subscriber; documented in the diff). The main.rs JSON-envelope println!s are untouched (the §6.2 machine contract).

Never-log test

tests/never_log.rs::rpc_dispatch_logging_records_method_but_never_the_request_token + ::emitted_records_never_contain_seed_or_token_sentinels (capturing subscriber, sentinel mnemonic + token asserted absent).

Version

0.38.0 — MINOR (feat:, backwards-compatible new capability: new control method + CLI verbs + logging; no breaking change).

Blast radius (gitnexus/socratic)

dispatch_control (control.rs) + CONTROL_METHODS + cli_covered_control_methods (drift test), the serve/run bring-up path (server.rs, win_service.rs, tls.rs, self_heal.rs), and the rpc handler dispatch. No public read-plane API changed; the new control method is additive/optional (extension unaffected). The engine crate dig_node_core is unchanged — its existing tracing events are now simply captured.

Verification

Local (CARGO_TARGET_DIR on a short path for Windows MAX_PATH): cargo build -p dig-node-service OK; cargo fmt --all --check clean; cargo clippy -p dig-node-service --all-targets clean; cargo test -p dig-node-service --lib --test never_log → 209 + 2 passed.

Co-Authored-By: Claude noreply@anthropic.com