feat(maestro): add ResolveAttach + RelaySetup/RelayAck wire variants (NAP-242)

DaemonOutbound: ResolveAttach (daemon → registry request) and RelayAck
(target → registry decision). DaemonInbound: ResolveAttachResult wrapping
RpcResult<AttachCandidates>, and RelaySetup (registry → target signal).
All correlated via reply_to, matching the existing CreateSession pattern.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/maestro-protocol/src/lib.rs

@@ -122,6 +122,20 @@ pub enum DaemonOutbound {
         reply_to: ReplyTo,
         result: RpcResult<()>,
     },
+    /// Home daemon asks the registry to resolve a session it doesn't own:
+    /// "where is session X and how do I reach it?" The registry replies with
+    /// [`DaemonInbound::ResolveAttachResult`] containing [`AttachCandidates`].
+    ResolveAttach {
+        reply_to: ReplyTo,
+        session_id: Uuid,
+    },
+    /// Target daemon answers a [`DaemonInbound::RelaySetup`]: whether it will
+    /// accept relay traffic for the requested session. Registry only allocates
+    /// relay capacity when `accepted == true`.
+    RelayAck {
+        reply_to: ReplyTo,
+        accepted: bool,
+    },
 }
 
 /// Messages the registry sends back to a daemon over the same WS.
@@ -138,6 +152,20 @@ pub enum DaemonInbound {
         reply_to: ReplyTo,
         id: Uuid,
     },
+    /// Registry's response to [`DaemonOutbound::ResolveAttach`]. `Err` covers
+    /// "session not found", "no daemon owns this session", etc.
+    ResolveAttachResult {
+        reply_to: ReplyTo,
+        result: RpcResult<AttachCandidates>,
+    },
+    /// Registry signals a target daemon that a home daemon wants to attach via
+    /// the registry-mediated relay (T3). Target evaluates `allow_inbound` and
+    /// replies with [`DaemonOutbound::RelayAck`].
+    RelaySetup {
+        reply_to: ReplyTo,
+        home_daemon: String,
+        session_id: Uuid,
+    },
 }
 
 // ---------------------------------------------------------------------------
@@ -541,6 +569,78 @@ mod tests {
         assert_eq!(json["type"], "DaemonRemoved");
     }
 
+    #[test]
+    fn daemon_outbound_resolve_attach_round_trip_and_tag() {
+        let msg = DaemonOutbound::ResolveAttach {
+            reply_to: Uuid::from_u128(11),
+            session_id: Uuid::from_u128(22),
+        };
+        let v = serde_json::to_value(&msg).unwrap();
+        assert_eq!(v["type"], "ResolveAttach");
+        assert_eq!(msg, round_trip(&msg));
+    }
+
+    #[test]
+    fn daemon_outbound_relay_ack_round_trip_and_tag() {
+        let msg = DaemonOutbound::RelayAck {
+            reply_to: Uuid::from_u128(33),
+            accepted: true,
+        };
+        let v = serde_json::to_value(&msg).unwrap();
+        assert_eq!(v["type"], "RelayAck");
+        assert_eq!(v["accepted"], true);
+        assert_eq!(msg, round_trip(&msg));
+
+        let denied = DaemonOutbound::RelayAck {
+            reply_to: Uuid::from_u128(34),
+            accepted: false,
+        };
+        assert_eq!(denied, round_trip(&denied));
+    }
+
+    #[test]
+    fn daemon_inbound_resolve_attach_result_round_trip() {
+        let ok = DaemonInbound::ResolveAttachResult {
+            reply_to: Uuid::from_u128(11),
+            result: RpcResult::Ok {
+                value: AttachCandidates {
+                    direct_wss: None,
+                    perimeter: Some(PerimeterCandidate {
+                        perimeter_id: "wg-naps62".into(),
+                        private_addr: "10.0.0.7:7070".into(),
+                    }),
+                    relay: None,
+                    jwt: "eyJ...".into(),
+                },
+            },
+        };
+        let err = DaemonInbound::ResolveAttachResult {
+            reply_to: Uuid::from_u128(12),
+            result: RpcResult::Err {
+                error: ErrorInfo {
+                    code: "unknown_session".into(),
+                    message: "no daemon owns session".into(),
+                },
+            },
+        };
+        for v in [ok, err] {
+            assert_eq!(v, round_trip(&v));
+        }
+    }
+
+    #[test]
+    fn daemon_inbound_relay_setup_round_trip_and_tag() {
+        let msg = DaemonInbound::RelaySetup {
+            reply_to: Uuid::from_u128(33),
+            home_daemon: "laptop".into(),
+            session_id: Uuid::from_u128(44),
+        };
+        let v = serde_json::to_value(&msg).unwrap();
+        assert_eq!(v["type"], "RelaySetup");
+        assert_eq!(v["home_daemon"], "laptop");
+        assert_eq!(msg, round_trip(&msg));
+    }
+
     #[test]
     fn perimeter_candidate_round_trips() {
         let p = PerimeterCandidate {