test(relay): cross-package e2e adversarial security harness

New e2e/ package wires the REAL P5(auth)+P4(crypto)+P2(agent) exports through
in-memory seams and an untrusted-relay attacker vantage (RelaySpy). Dynamically
re-validates F1–F4/F6 plus MITM/reflection/replay/reorder/INV2/cross-tenant/
single-use — every assertion runs the production code path. 21 tests green, tsc
clean. node_modules via symlinks (gitignored); no npm install needed.

e2e/harness/spy.ts

@@ -0,0 +1,34 @@
+/**
+ * RelaySpy — the untrusted-relay / attacker vantage. A passthrough that records every ciphertext
+ * byte it forwards (exactly what a malicious relay can see). INV2: a known plaintext marker must
+ * NEVER appear in `captured`. Mirrors the `relay-e2e/test/integration.test.ts` spy.
+ */
+import { MAX_FRAME_BYTES } from 'relay-e2e'
+
+export class RelaySpy {
+  readonly captured: Uint8Array[] = []
+
+  /** Forward a sealed payload, recording a copy of the ciphertext the relay observes. */
+  forward(payload: Uint8Array): Uint8Array {
+    if (payload.length > MAX_FRAME_BYTES) {
+      throw new Error(`payload exceeds MAX_FRAME_BYTES (${payload.length} > ${MAX_FRAME_BYTES})`)
+    }
+    this.captured.push(payload.slice())
+    return payload
+  }
+
+  /** Latin1 concatenation of everything the relay saw — for substring canary scans. */
+  snapshot(): string {
+    return this.captured.map((b) => Buffer.from(b).toString('latin1')).join(' ')
+  }
+
+  /** True if `marker` appears in ANY captured frame (utf8 or latin1) — INV2 tripwire. */
+  contains(marker: string): boolean {
+    if (this.snapshot().includes(marker)) return true
+    return this.captured.some(
+      (b) =>
+        Buffer.from(b).toString('utf8').includes(marker) ||
+        Buffer.from(b).toString('latin1').includes(marker),
+    )
+  }
+}