[mesh] Inject-reject-accept demo script for laptop

[jdev-02]

Owner: P3 (impl), Pair: P2 (signer)

Done so far: single-device construct shipped via security/cot_inject_demo.py

• recording S1 (docs/demo-clips/2254-security-cot-inject-demo.mp4). This is
  already adequate for the §12 pitch beat 3:00-3:30.

Optional stretch (this issue): two-device side-by-side over the multicast
wire. Requires mesh/inject_demo.py + a second laptop running the verifier.
Defer to post-pitch unless Sun 0700 stretch decision is GO.

Acceptance: unchanged (two-device demo).