Define the serde bool default once in state.rs

[kridaydave]

Problem

fn default_true() -> bool { true } was written out three times with identical bodies: src/state.rs:23, src/fabric.rs:37, src/server.rs:239. It is the serde default behind five fields (Runtime.pinned, Policy.require_signed, Policy.require_check_strict, CheckReq.strict, and one more), so it is policy that already has a canonical home.

Change

A serde(default = "...") attribute accepts a path, so fabric.rs and server.rs now point at crate::state::default_true and their private copies are deleted. state.rs makes the one copy pub(crate).

No behavior change. The three bodies were byte-identical, and the attribute resolves to the same function.

Diff

 src/fabric.rs | 8 ++------
 src/server.rs | 6 +-----
 src/state.rs  | 2 +-
 3 files changed, 4 insertions(+), 12 deletions(-)

Verification

cargo fmt --all -- --check clean, cargo clippy --locked -- -D warnings clean. The test suite is CI's to run.

Not shipped

• src/registry.rs:82-88 and src/registry.rs:147-152 re-check the hash after StateEngine::verify, which already does the identical check at src/engine.rs:74-80. Dead. Not removed here because it touches the security boundary and deserves its own PR with its own proof.
• src/registry.rs:273-274 is a stale comment describing a lowercase normalization that is not in the code.