fix(transport): harden QUIC admission boundaries

core/tests/protocol_fixtures.rs

@@ -145,6 +145,14 @@ fn manifest_public_identity_requires_dns_sni_not_ip_or_uuid() {
             "non-DNS SNI accepted: {invalid_identity}"
         );
     }
+
+    let identity_equals_dns_shaped_gateway_id = String::from_utf8(valid_manifest().to_vec())
+        .expect("fixture is UTF-8")
+        .replace("\"id\":\"gateway\"", "\"id\":\"gateway.test\"");
+    assert!(
+        ConnectionManifest::decode(identity_equals_dns_shaped_gateway_id.as_bytes()).is_err(),
+        "public SNI identity matched the logical gateway id"
+    );
 }
 
 #[test]