[client] pqkem: address review findings on convergence, strict parsing and status

Bot review (CodeRabbit, cubic) on PR #7098 surfaced several real defects:

- Strict() parsed the raw env value instead of the normalized one, so a
  mixed-case NB_PQ_MLKEM_STRICT such as "tRuE" silently disabled fail-closed
  mode. Parse the lower-cased value, matching Enabled().
- OnDataPathMessage labeled a data-path answer as "signal" in logs, mislabeling
  every rotation answer. Use the data-path label.
- A failed sendAnswer aborted the whole connection setup, skipping the relay/ICE
  listeners; a transient signalling failure now still brings the local transport
  up (the peer retries the answer).
- processOffer left the reserved exchange slot in place when Respond failed, so
  every retransmission of that offer was dropped forever. Clear the reservation
  on a pre-commit error so a retry can derive again.
- Dropped a no-op time.Since that implied a convergence-latency metric that was
  never recorded, and the now-unused startedAt field.
- The strict-mode status line asserted active blocking even for a peer that is
  simply offline; reword it to state that no PSK is established yet.
- conn_test used t.Fatalf for conditions under test; use assert.

client/internal/pqkem/env.go

@@ -43,15 +43,16 @@ const EnvStrict = "NB_PQ_MLKEM_STRICT"
 // Strict reports whether strict (fail-closed) mode is enabled via the environment.
 // An empty or unrecognized value is treated as disabled (opportunistic).
 func Strict() bool {
-	switch strings.ToLower(strings.TrimSpace(os.Getenv(EnvStrict))) {
+	raw := strings.ToLower(strings.TrimSpace(os.Getenv(EnvStrict)))
+	switch raw {
 	case "on":
 		return true
 	case "", "off":
 		return false
 	}
-	enabled, err := strconv.ParseBool(strings.TrimSpace(os.Getenv(EnvStrict)))
+	enabled, err := strconv.ParseBool(raw)
 	if err != nil {
-		log.Warnf("failed to parse %s value %q: %v", EnvStrict, os.Getenv(EnvStrict), err)
+		log.Warnf("failed to parse %s value %q: %v", EnvStrict, raw, err)
 		return false
 	}
 	return enabled