fix(cubesys): HELLO ACK + ad-hoc E2E proof of multi-tenant routing (Task 3)

The wire protocol required an explicit HELLO acknowledgement frame; a
HELLO-only client would otherwise block on the next recv. Add the ACK.

Ad-hoc E2E (real built cube-server, real 4-byte LE framed Unix socket):
  - SHARED mode: a HELLO tenant and a no-HELLO client share ONE store
    (write visible across both) — backward-compatible with cubec/stress.sh.
  - PER-TENANT mode (--tenant-dir): two HELLO tenants are HARD-isolated
    (T2 and default tenant cannot see T1's record).

Verifier: /tmp/hermes-verify-driver.sh + /tmp/hermes-verify-e2e.py

cubesys/src/bin/cube-server.rs

@@ -100,6 +100,19 @@ impl Server {
                                                 }
                                             };
                                             ts.set_identity(ident);
+                                            // Acknowledge the HELLO so the
+                                            // client can proceed to commands.
+                                            if write_frame(
+                                                &mut stream,
+                                                &format!(
+                                                    "ok: tenant {}",
+                                                    ts.identity().unwrap().tenant.as_str()
+                                                ),
+                                            )
+                                            .is_err()
+                                            {
+                                                return;
+                                            }
                                             ts
                                         }
                                         Err(e) => {