feat(rfq): add durable provider state machine

[tvolk131]

Summary

• add a transport-free deadcat-rfq-provider crate with provider/chain-bound durable inventory and owner-scoped, idempotent multi-input reservations
• define the exclusive accept-before deadline and persist the exact commit-before-sign point of no return, recovery job, signed response, and permanent committed-input retirement
• enforce immediate durability, durable clock rollback protection, request-bounded lazy expiry plus capped sweeps, immutable fee policy, and fail-closed whole-store integrity checks on startup
• add ADR 0007 and align the RFQ roadmap with the durable-acceptance-before-signing flow

Trust boundary

This PR deliberately does not add pricing, wallet discovery, concrete PSET validation, signing, transport, relay, or chain reconciliation. The safety-critical commit and signed-result transitions remain crate-private until the concrete validator and signer adapter can be their only production callers; detached fee assertions and arbitrary signed bytes are therefore not exposed as service inputs.

Verification

• nix develop .#default --command just ci-checks
  • strict workspace formatting and Clippy
  • 258 workspace tests passed (6 intentionally skipped)
  • all workspace doc tests passed
  • WASM build check passed
• 25 focused provider tests cover deadline boundaries, fee admission, atomic/idempotent allocation, concurrency, failure rollback, durable clock observations, restart recovery, permanent retirement, bounded expiry, and direct corruption fixtures
• two independent final review passes found no remaining P0/P1 issues

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a45bb8296e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Observe time before rejecting the fee policy

When a wrong-policy reservation request is the only operation received after an existing quote's deadline, this early return skips begin_timed_write and leaves the clock high-water mark unchanged. If the system clock then rolls back below that deadline, commit_before_sign can accept the existing reservation even though the provider had already observed a later real time, defeating the rollback protection and durable accept-before guarantee. Acquire the timed writer and persist the observation before performing this policy check, as the authenticated failure paths already do.

Useful? React with 👍 / 👎.