state: resolve changed peers through adjacency

ListPeers now filters named peers against the recipient's adjacency, so
a node the policy hides is never delivered.

Updates #3417

hscontrol/mapper/mapper.go

@@ -438,9 +438,9 @@ func (m *mapper) buildFromChange(
 // incremental peer-change and user-profile paths, computed from the same live
 // per-node matchers and [policy.ReduceNodes] filter that
 // [MapResponseBuilder.buildTailPeers] applies to full peer objects, so the
-// paths cannot drift. The snapshot peer map ([NodeStore.ListPeers]) is used
-// only as the candidate set, matching buildTailPeers; the live policy decides
-// visibility because the snapshot is not rebuilt on policy changes.
+// paths cannot drift. The recipient's adjacency from the NodeStore
+// ([NodeStore.ListPeers]) is the authority for which peers exist for it; the
+// live matchers only narrow that set further, matching buildTailPeers.
 //
 // ok is false when the node or its matchers cannot be resolved; callers must
 // then fail closed (emit nothing) rather than risk leaking forbidden peers.

hscontrol/mapper/mapper_test.go

@@ -485,12 +485,12 @@ func TestBuildFromChangeVisibilityMatchesFullMap(t *testing.T) {
 		return false
 	}
 
-	// wantFull pins the actual peer-visibility semantics so the invariant below
-	// cannot pass vacuously (e.g. if every path broke to zero identically).
-	// Note deny_all: an empty ACL set compiles to zero matchers, which headscale
-	// treats as "no visibility restriction" — all peers are visible on every
-	// path (the packet filter denies traffic separately). user_isolation and
-	// autogroup_self are the discriminating cases that prove filtering works.
+	// wantFull pins the actual peer-visibility semantics so the cross-path
+	// check below cannot pass vacuously (e.g. if every path broke to zero
+	// identically).
+	// Note deny_all: an empty ACL set yields no peer adjacency, so nothing is
+	// visible on any path. user_isolation and autogroup_self remain the
+	// discriminating cases that prove filtering works.
 	tests := []struct {
 		name     string
 		policy   string
@@ -505,7 +505,7 @@ func TestBuildFromChangeVisibilityMatchesFullMap(t *testing.T) {
 			]}`,
 			1,
 		},
-		{"deny_all", `{"acls":[]}`, 2},
+		{"deny_all", `{"acls":[]}`, 0},
 		{
 			"autogroup_self",
 			`{"acls":[{"action":"accept","src":["autogroup:member"],"dst":["autogroup:self:*"]}]}`,