feat(mazenet): topology package — config, status machine, generator, persistence

Adds decnet/topology/ with:

- config.TopologyConfig: pydantic model driving generation (depth,
  branching_factor, deckies_per_lan_min/max, bridge_forward_probability,
  cross_edge_probability, subnet_base_prefix, service selection, seed).
  Emits GeneratedTopology dataclass (lans, deckies, edges).

- status.TopologyStatus + assert_transition: seven-state machine with
  an explicit legal-transition table.  torn_down is terminal; degraded
  is schema-reserved for future Healer use.

- generator.generate: deterministic DAG generation under config.seed.
  Builds a tree of LANs (DMZ at root), plants deckies in each LAN,
  promotes one decky per non-DMZ LAN to a parent bridge, and rolls
  cross-edges per cross_edge_probability for DAG shape.

- persistence: persist() writes a plan to the repo as pending;
  transition_status() enforces state-machine legality; hydrate() loads
  topology + children into a single dict.

Covered by tests/topology/{test_status,test_generator,test_persistence}.

tests/topology/test_persistence.py

@@ -0,0 +1,91 @@
+"""MazeNET persistence-layer tests: generator → repo → hydrate roundtrip."""
+import pytest
+
+from decnet.topology.config import TopologyConfig
+from decnet.topology.generator import generate
+from decnet.topology.persistence import (
+    hydrate,
+    persist,
+    transition_status,
+)
+from decnet.topology.status import TopologyStatus, TopologyStatusError
+from decnet.web.db.factory import get_repository
+
+
+@pytest.fixture
+async def repo(tmp_path):
+    r = get_repository(db_path=str(tmp_path / "persist.db"))
+    await r.initialize()
+    return r
+
+
+def _config(**kw) -> TopologyConfig:
+    base = dict(
+        name="roundtrip",
+        depth=2,
+        branching_factor=2,
+        deckies_per_lan_min=1,
+        deckies_per_lan_max=2,
+        cross_edge_probability=0.0,
+        randomize_services=True,
+        seed=7,
+    )
+    base.update(kw)
+    return TopologyConfig(**base)
+
+
+@pytest.mark.anyio
+async def test_persist_then_hydrate(repo):
+    plan = generate(_config())
+    tid = await persist(repo, plan)
+
+    hydrated = await hydrate(repo, tid)
+    assert hydrated is not None
+    assert hydrated["topology"]["name"] == "roundtrip"
+    assert hydrated["topology"]["status"] == TopologyStatus.PENDING
+    assert len(hydrated["lans"]) == len(plan.lans)
+    assert len(hydrated["deckies"]) == len(plan.deckies)
+    assert len(hydrated["edges"]) == len(plan.edges)
+
+    # LANs round-trip with their DMZ flag and subnet.
+    by_name = {lan["name"]: lan for lan in hydrated["lans"]}
+    for planned in plan.lans:
+        assert by_name[planned.name]["subnet"] == planned.subnet
+        assert by_name[planned.name]["is_dmz"] == planned.is_dmz
+
+    # Deckies round-trip their services as a list, not a string.
+    for d in hydrated["deckies"]:
+        assert isinstance(d["services"], list)
+
+
+@pytest.mark.anyio
+async def test_transition_status_enforces_legality(repo):
+    plan = generate(_config())
+    tid = await persist(repo, plan)
+
+    await transition_status(repo, tid, TopologyStatus.DEPLOYING, reason="go")
+    await transition_status(repo, tid, TopologyStatus.ACTIVE)
+    topo = await repo.get_topology(tid)
+    assert topo["status"] == TopologyStatus.ACTIVE
+
+    # Can't go from active directly back to pending.
+    with pytest.raises(TopologyStatusError):
+        await transition_status(repo, tid, TopologyStatus.PENDING)
+
+    # Unknown topology raises ValueError, not silent no-op.
+    with pytest.raises(ValueError):
+        await transition_status(repo, "does-not-exist", TopologyStatus.ACTIVE)
+
+
+@pytest.mark.anyio
+async def test_hydrate_missing_topology(repo):
+    assert await hydrate(repo, "no-such-id") is None
+
+
+@pytest.mark.anyio
+async def test_config_snapshot_preserves_seed(repo):
+    plan = generate(_config(seed=12345))
+    tid = await persist(repo, plan)
+    topo = await repo.get_topology(tid)
+    assert topo["config_snapshot"]["seed"] == 12345
+    assert topo["config_snapshot"]["depth"] == 2