Extract shared contract, drop BinaryFormatter wire, modernize to net8/x64

Make the Console<->Launcher system source-built and modern now that the console
is under our control and the WinXP-era pods are gone.

Contract extraction (Contract/Tesla.Contract.csproj):
- One multi-targeted (net48;net8.0-windows) source project for the RPC contract,
  replacing the vendored TeslaConsoleLaunchLib.dll and the hand-synced Tesla.Net
  replica in Launcher/LaunchModels_Shared.cs. Emits assembly TeslaConsoleLaunchLib.

SecureConfig extraction (SecureConfig/Tesla.SecureConfig.csproj):
- net48 source of the first-boot provisioning protocol (UDP beacons, OFB crypto,
  RSA key exchange), replacing the vendored TeslaSecureConfiguration.dll.

Remove BinaryFormatter from the wire (RCE sink + the reason net6 was pinned):
- Console<->Launcher RPC is now length-prefixed System.Text.Json frames
  (Contract/PodRpcProtocol.cs) over the unchanged OFB transport; dispatch by
  method name. Deleted the SerializationBinder / MethodInfoProxy machinery.
- Console-local BinaryFormatter (Site config, mission replays) intentionally
  retained: local net48 file I/O, not the network surface.

Runtime modernization:
- Launcher Service + Agent: net6 -> net8, win-x86 -> win-x64 (all pods are
  64-bit Win10). Kept the SHA1-default PBKDF2 (Console key-derivation compat)
  with SYSLIB0041 suppressed and documented.

Tests: differential suite now 73 green. Added SecureConfigCompatTests (OFB
ciphertext byte-identical to the vendored DLL) and PodRpcProtocolTests (JSON
round-trip of every request/response shape); removed the now-obsolete
BinaryFormatter byte-identity guard.

Build hygiene: per-project obj dirs (Launcher/Directory.Build.props) fix a
NuGet restore collision between the two Launcher projects sharing one folder.

NOT runtime-verified against a live pod.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Console/README.md

@@ -20,20 +20,49 @@ it is otherwise a faithful decompilation, not a rewrite.
 
 ## Dependencies
 
-The console references five assemblies, vendored as binaries under `lib/`
-(copied from `assets/Tesla Console/`):
+The console references these assemblies. Most are vendored as binaries under
+`lib/` (copied from `assets/Tesla Console/`):
 
 | Assembly | Origin |
 |----------|--------|
 | `WeifenLuo.WinFormsUI.Docking.dll` | Third-party docking UI (open source, see `assets/Tesla Console/WeifenLuo.txt`) |
-| `TeslaConsoleLaunchLib.dll` | Wire types / launch protocol (proprietary) |
-| `TeslaSecureConfiguration.dll` | First-boot secure config protocol (proprietary) |
-| `Munga Net.dll` | Networking helpers (proprietary) |
-| `BitmapLibrary.dll` | Plasma-display bitmap rendering (proprietary) |
+| `TeslaConsoleLaunchLib.dll` | Wire types / launch protocol — **now built from source** (see below) |
+| `TeslaSecureConfiguration.dll` | First-boot secure config protocol — **now built from source** (see below) |
+| `Munga Net.dll` | Managed C# client for the Red Planet game's Munga protocol (TCP 1501); manual binary serialization, no BinaryFormatter (proprietary, vendored) |
+| `BitmapLibrary.dll` | Plasma-display bitmap rendering (proprietary, vendored) |
 
-These are still referenced as compiled binaries. They are also .NET 2.0 managed
-assemblies and could be decompiled to source later if full-source builds are
-needed.
+> The Red Planet game itself is C++ and lives in its own repo (`c:\vwe\rp411` /
+> `gitea.mysticmachines.com/VWE/RP411.git`). That source defines the Munga protocol
+> but is **not** a drop-in for the managed `Munga Net.dll` above, so it is not
+> vendored here.
+
+Two of these are no longer vendored binaries — they are built from source and
+shared across the suite:
+
+- `TeslaConsoleLaunchLib` ← `../Contract/Tesla.Contract.csproj`, a multi-targeted
+  `net48;net8.0-windows` project: the single source of truth for the Console↔Launcher
+  RPC contract (wire types, the `PodManagerConnection` client, and the framed-JSON
+  `PodRpc` protocol), shared with the Launcher Service. The assembly keeps the
+  `TeslaConsoleLaunchLib` name so the original-exe baseline still resolves in the
+  differential tests; the wire no longer embeds assembly names (see RPC note below).
+- `TeslaSecureConfiguration` ← `../SecureConfig/Tesla.SecureConfig.csproj` (net48),
+  the first-boot provisioning protocol (UDP beacons, OFB crypto, RSA key exchange).
+
+The original `TeslaSecureConfiguration.dll` is retained under `lib/` as the baseline
+for the byte-identical crypto guard (`SecureConfigCompatTests`). The remaining
+vendored assemblies (`Munga Net`, `BitmapLibrary`) are .NET 2.0 managed and could be
+decompiled to source the same way if full-source builds are needed.
+
+### Console ↔ Launcher RPC (no BinaryFormatter)
+
+The pod-management channel (TCP 53290) runs **length-prefixed System.Text.Json**
+frames over the existing OFB-encrypted stream — see `Contract/PodRpcProtocol.cs`,
+shared verbatim by both ends. This replaced the original `BinaryFormatter` +
+serialized-`MethodBase` scheme (a remote-code-execution sink and the reason the
+Launcher was pinned to EOL .NET 6); dispatch is now by method-name string. The
+Launcher Service/Agent target **net8**. Note the Console still uses `BinaryFormatter`
+for *local* disk persistence (`Site` config, mission results) — that is local file
+I/O on net48, not the network surface, and is intentionally left alone.
 
 ## Layout