feat(rfq): add wallet inventory and signer boundary

[tvolk131]

Summary

• add backend-neutral provider capabilities for complete inventory discovery, confidential receive/change destinations, and durable-job-only signing
• authenticate confidential tree-less P2TR inventory, retain input openings only in redacted memory, and persist only non-secret recovery metadata
• make quote eligibility the intersection of a fresh complete wallet snapshot and durable Available state
• bind exact wallet locators, internal keys, outpoints, and inventory commitments into durable signing targets with explicit SIGHASH_ALL
• update ADR 0007, the liquidity roadmap, and repository scope documentation

Why

ADR 0007 requires the provider to reserve only authoritative wallet inventory and to recover signing work without depending on an input remaining in the current unspent set. Durable allocation state alone cannot prove that an output is still wallet-owned, unspent, or fresh enough to quote.

This change adds the wallet-capability boundary and quote-facing inventory coordinator while deliberately leaving concrete wallet/RPC/HSM implementations, pricing, final-PSET validation, networking, relay, and reconciliation to later milestones.

Safety properties

• complete snapshots are canonical, provider/chain-bound, size-bounded, and fail closed
• stale, superseded, contradictory, or post-writer-lock-expired snapshots cannot authorize new reservations
• exact idempotent retries replay durable results without allocating inventory again
• reserved and committed outputs never re-enter quote eligibility merely because the wallet rediscovers them
• confidential openings and blinding factors never enter redb, quote-facing public accessors, signing targets, or debug output
• signer responses must match every durable target in order and use explicit 65-byte SIGHASH_ALL

Validation

• nix develop .#default --command just ci-checks
• 283 workspace tests passed
• 50 focused RFQ-provider tests passed
• workspace clippy passed with warnings denied
• doc tests, formatting, generated-contract check, and WASM check passed

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}