Bound peer gossip keys deterministically per site #473

Context

collect_gossip_peer_pins can gather multiple distinct verified keys for one peer site name from matching GridSite objects. If the set exceeds MAX_PINNED_KEYS_PER_ORIGIN, pin_origin_for_grid rejects it; install_peer_pins then removes that origin's pin and excludes the peer, so its signed state is rejected.

Desired behavior

Apply an explicit, deterministic bound to each site's keys before installing the peer-pin snapshot. The selection must be independent of Kubernetes resource iteration order, and excess keys must not cause the entire peer to be excluded.

Add coverage for a site with more than the configured maximum, including stable selection when the input resource order changes.

Source: PR #430 review comment