Split hybrid public keys into separate wire fields

The packed 1216-byte hybrid public had no consumer that wanted it
whole -- everything unpacked immediately. Message layouts and the
credential record now carry peer_m | peer_x as explicit fields; _PUB
and the unpack-at-use idiom are gone. credential_id values change with
the record layout. Step comments in the exchange methods explain what
each solve/challenge proves.

docs/design.md

@@ -47,7 +47,7 @@ an application-chosen id: either the bare 32-byte registration secret
 unhashed; the kdf info strings provide all domain separation needed) or
 the composite written by the first successful registration:
 
-    idroot(32) | shared'(32) | peer_public_key(1216) | sas(4) | verified(1)
+    idroot(32) | shared'(32) | peer_m(1184) | peer_x(32) | sas(4) | verified(1)
 
 The rotation to shared' is derived when the exchange completes but only
 held in memory: the store swap waits for the key change -- the