Tenderlink: Backpressure full ACK tracking window

[endophysics]

ACK-window panic is caused by the transport layer continuing to send packets after its ACK-tracking ring is full:

state.send_sequence_number - state.packets_waiting_ack_tail < 2048 * 64

That condition can fail under congestion, loss, or delayed ACK processing. It means the sender has too many unacknowledged packets outstanding for the fixed-size tracking window.

• Introduces ACK_TRACKING_PACKET_CAPACITY for the fixed ACK ring size.
• Replaces the panic/assert with a verbose diagnostic log.
• Uses saturating_sub() when measuring outstanding ACK-tracked packets.
• Prevents new TU probes, keepalives, and unreliable data sends while the ACK window is full.
• Allows sending to resume once packets are ACKed or declared lost and the tracking tail advances.

This preserves the existing ACK-ring design but makes congestion behavior non-fatal: instead of panicking when the sender outruns ACK tracking, Tenderlink pauses outbound sends until capacity is available again.