feat(clustering): identity clusterer worker skeleton

Adds the decnet clusterer master-only command + provider-subpackage
shape (base.py + factory.py + impl/connected_components.py) so
subsequent commits can land similarity-graph features without
churning callers.

The skeleton ConnectedComponentsClusterer.tick is a no-op; the
worker shell is fully wired (bus consumer on attacker.observed +
attacker.scored, slow-tick fallback, health heartbeat, control
listener, ClusterResult fan-out to identity.formed/observation.linked
/merged). Subscribers on identity.> see no events from this clusterer
until edge functions land, but the lifecycle is in place.

tests/clustering/test_clusterer_factory.py

@@ -0,0 +1,34 @@
+"""Tests for :mod:`decnet.clustering.factory`."""
+from __future__ import annotations
+
+import pytest
+
+from decnet.clustering.base import Clusterer
+from decnet.clustering.factory import get_clusterer
+from decnet.clustering.impl.connected_components import ConnectedComponentsClusterer
+
+
+def test_default_returns_connected_components(monkeypatch):
+    monkeypatch.delenv("DECNET_CLUSTERER_TYPE", raising=False)
+    c = get_clusterer()
+    assert isinstance(c, ConnectedComponentsClusterer)
+    assert isinstance(c, Clusterer)
+    assert c.name == "connected_components"
+
+
+def test_explicit_connected_components(monkeypatch):
+    monkeypatch.setenv("DECNET_CLUSTERER_TYPE", "connected_components")
+    c = get_clusterer()
+    assert isinstance(c, ConnectedComponentsClusterer)
+
+
+def test_unknown_clusterer_type_raises(monkeypatch):
+    monkeypatch.setenv("DECNET_CLUSTERER_TYPE", "nope")
+    with pytest.raises(ValueError, match="Unknown clusterer"):
+        get_clusterer()
+
+
+def test_case_insensitive(monkeypatch):
+    monkeypatch.setenv("DECNET_CLUSTERER_TYPE", "  CONNECTED_COMPONENTS  ")
+    c = get_clusterer()
+    assert isinstance(c, ConnectedComponentsClusterer)