feat(sniffer): publish decky.{id}.traffic on the bus (DEBT-031)

SnifferEngine gains an optional publish_fn hook, invoked after the
dedup + syslog write for traffic-summary events only (tls_session,
tcp_flow_timing, tcp_syn_fingerprint) — intermediate parser artifacts
like tls_client_hello stay off the bus.

The sniffer worker wires get_bus() + a thread-safe shim that marshals
sync calls from the scapy sniff thread back onto the asyncio loop via
run_coroutine_threadsafe.  Bus failure at startup degrades cleanly to
publish-off mode; publish failures at runtime never escape the sniff
thread.

decnet/sniffer/worker.py

@@ -11,12 +11,18 @@ The API never depends on this worker being alive.
 """
 
 import asyncio
+import contextlib
 import os
 import subprocess  # nosec B404 — needed for interface checks
 import threading
 from concurrent.futures import ThreadPoolExecutor
 from pathlib import Path
+from typing import Any, Callable
 
+from decnet.bus import topics as _topics
+from decnet.bus.base import BaseBus
+from decnet.bus.factory import get_bus
+from decnet.bus.publish import publish_safely
 from decnet.logging import get_logger
 from decnet.network import HOST_IPVLAN_IFACE, HOST_MACVLAN_IFACE
 from decnet.sniffer.fingerprint import SnifferEngine
@@ -41,6 +47,30 @@ def _load_ip_to_decky() -> dict[str, str]:
     return mapping
 
 
+def _make_thread_safe_publisher(
+    bus: BaseBus,
+    loop: asyncio.AbstractEventLoop,
+) -> Callable[[str, str, dict[str, Any]], None]:
+    """Build a sync callable that marshals bus publishes back to *loop*.
+
+    The scapy sniff loop runs in a dedicated worker thread and cannot
+    ``await`` anything.  Every call here schedules the async publish on
+    the event loop and returns immediately; the sniff thread is never
+    blocked waiting for the publish to actually land on the wire.
+    """
+    def _publish(decky_name: str, event_type: str, payload: dict[str, Any]) -> None:
+        topic = _topics.decky(decky_name, _topics.DECKY_TRAFFIC)
+        try:
+            asyncio.run_coroutine_threadsafe(
+                publish_safely(bus, topic, payload, event_type=event_type),
+                loop,
+            )
+        except Exception as exc:  # noqa: BLE001
+            logger.debug("sniffer: cross-thread bus publish failed: %s", exc)
+
+    return _publish
+
+
 def _interface_exists(iface: str) -> bool:
     """Check if a network interface exists on this host."""
     try:
@@ -59,6 +89,7 @@ def _sniff_loop(
     log_path: Path,
     json_path: Path,
     stop_event: threading.Event,
+    publish_fn: Callable[[str, str, dict[str, Any]], None] | None = None,
 ) -> None:
     """Blocking sniff loop. Runs in a dedicated thread via asyncio.to_thread."""
     try:
@@ -75,7 +106,9 @@ def _sniff_loop(
     def _write_fn(line: str) -> None:
         write_event(line, log_path, json_path)
 
-    engine = SnifferEngine(ip_to_decky=ip_map, write_fn=_write_fn)
+    engine = SnifferEngine(
+        ip_to_decky=ip_map, write_fn=_write_fn, publish_fn=publish_fn,
+    )
 
     # Periodically refresh IP map in a background daemon thread
     def _refresh_loop() -> None:
@@ -150,6 +183,25 @@ async def sniffer_worker(log_file: str) -> None:
 
         stop_event = threading.Event()
 
+        loop = asyncio.get_running_loop()
+
+        # Connect to the bus for decky.{id}.traffic fan-out.  Failure here
+        # is non-fatal: the sniffer still writes syslog, it just doesn't
+        # push notifications to downstream consumers.
+        bus: BaseBus | None = None
+        try:
+            candidate = get_bus(client_name="sniffer")
+            await candidate.connect()
+            bus = candidate
+        except Exception as exc:  # noqa: BLE001
+            logger.warning(
+                "sniffer: bus unavailable, running in publish-off mode: %s", exc,
+            )
+
+        publish_fn: Callable[[str, str, dict[str, Any]], None] | None = None
+        if bus is not None:
+            publish_fn = _make_thread_safe_publisher(bus, loop)
+
         # Dedicated thread pool so the long-running sniff loop doesn't
         # occupy a slot in the default asyncio executor.
         sniffer_pool = ThreadPoolExecutor(
@@ -157,10 +209,9 @@ async def sniffer_worker(log_file: str) -> None:
         )
 
         try:
-            loop = asyncio.get_running_loop()
             await loop.run_in_executor(
                 sniffer_pool, _sniff_loop,
-                interface, log_path, json_path, stop_event,
+                interface, log_path, json_path, stop_event, publish_fn,
             )
         except asyncio.CancelledError:
             logger.info("sniffer: shutdown requested")
@@ -169,6 +220,9 @@ async def sniffer_worker(log_file: str) -> None:
             raise
         finally:
             sniffer_pool.shutdown(wait=False)
+            if bus is not None:
+                with contextlib.suppress(Exception):
+                    await bus.close()
 
     except asyncio.CancelledError:
         raise