refactor(qbft): make MessageType/UponRule enums and remove panic

[iamquang95]

Fix #637

MessageType and UponRule were i64 newtypes, so no match was exhaustive and the catch-all arms panicked. They are now #[repr(i64)] enums with unchanged discriminants; the MSG_* / UPON_* consts stay as aliases so call sites and the parity suites are untouched.

• TryFrom<i64> for MessageType accepts 1..=5 and is now the single admission check at the wire boundary.
• All 11 panic!("bug: …") sites return QbftError::SanityCheck, mirroring charon's qbft sanity check: %v recovery. Payloads match charon byte-for-byte.
• Both catch_unwind calls removed from internal_test.rs; the 14 .expect() sites are untouched.

The nested-justification panic from the issue was already unreachable from the wire (proto cannot express nesting, constructor flattens, verify_msg type-gates). The gain is that the one wire-reachable sanity failure now surfaces as a typed error with a metric instead of an untyped Error::Join.

[varex83]

LGTM!