feat(mazenet): topology package — config, status machine, generator, persistence

Adds decnet/topology/ with:

- config.TopologyConfig: pydantic model driving generation (depth,
  branching_factor, deckies_per_lan_min/max, bridge_forward_probability,
  cross_edge_probability, subnet_base_prefix, service selection, seed).
  Emits GeneratedTopology dataclass (lans, deckies, edges).

- status.TopologyStatus + assert_transition: seven-state machine with
  an explicit legal-transition table.  torn_down is terminal; degraded
  is schema-reserved for future Healer use.

- generator.generate: deterministic DAG generation under config.seed.
  Builds a tree of LANs (DMZ at root), plants deckies in each LAN,
  promotes one decky per non-DMZ LAN to a parent bridge, and rolls
  cross-edges per cross_edge_probability for DAG shape.

- persistence: persist() writes a plan to the repo as pending;
  transition_status() enforces state-machine legality; hydrate() loads
  topology + children into a single dict.

Covered by tests/topology/{test_status,test_generator,test_persistence}.

decnet/topology/__init__.py

@@ -0,0 +1,23 @@
+"""MazeNET — nested deception topologies.
+
+A topology is an arbitrary-depth DAG of LANs, connected by multi-homed
+"bridge deckies" that optionally forward L3 between segments.  One LAN
+is marked as the DMZ (Internet-facing).  Persisted via the repo pattern;
+deployed via :mod:`decnet.engine.deployer`.
+"""
+from decnet.topology.config import TopologyConfig, GeneratedTopology
+from decnet.topology.generator import generate
+from decnet.topology.status import (
+    TopologyStatus,
+    assert_transition,
+    TopologyStatusError,
+)
+
+__all__ = [
+    "TopologyConfig",
+    "GeneratedTopology",
+    "generate",
+    "TopologyStatus",
+    "assert_transition",
+    "TopologyStatusError",
+]