Split hybrid public keys into separate wire fields

The packed 1216-byte hybrid public had no consumer that wanted it
whole -- everything unpacked immediately. Message layouts and the
credential record now carry peer_m | peer_x as explicit fields; _PUB
and the unpack-at-use idiom are gone. credential_id values change with
the record layout. Step comments in the exchange methods explain what
each solve/challenge proves.

tests/test_ws.py

@@ -186,7 +186,7 @@ async def test_verification_callback():
     assert await srv.receive() == b"resumed"
     assert seen == []  # no comparison asked
     assert not srv.session.verified and not cli.session.verified
-    assert cli.session.verification.sas == _CREDENTIAL.unpack(cred_cli)[3]
+    assert cli.session.verification.sas == _CREDENTIAL.unpack(cred_cli)[4]
     cli.session.confirm(True)  # compared out of band: mark verified
     srv.session.confirm(True)
     assert cli.session.verified and srv.session.verified