feat(rfq): finalize durable provider settlements

[tvolk131]

Summary

• add a transport-free provider signing coordinator that accepts only an exact durable signing job
• verify explicit Taproot SIGHASH_ALL provider signatures, insert only the provider signature fields, and revalidate the canonical completed PSET
• make a private verified-PSET capability the only production path to signed-artifact persistence
• project finalized PSET size before the irreversible commit boundary
• preserve exact crash recovery and make concurrent valid signing attempts converge on one durable artifact
• redact signing payloads from debug output and update the RFQ roadmap/ADRs

Safety and recovery

The coordinator exact-matches the complete job and permanent provider allocations before invoking the signer. It maps targets by outpoint, verifies signatures against all committed prevouts and the provider chain identity, proves that no unrelated PSET field changed, then rechecks confidential proofs, balance, canonical encoding, size, and fee/weight facts before persistence.

Signing happens outside database locks. The signed-state transition is atomic and restart-safe: the first valid candidate persisted is authoritative, concurrent or stale-clock workers discard their local candidate and replay that exact winner, and persistence failures leave the exact committed job recoverable without exposing signed bytes.

The initial profile remains intentionally limited to one interactive RFQ provider plus finalized tree-less P2TR key-path inputs. Simplicity covenant inputs and multiple interactive RFQ providers remain future venue-verification work.

Validation

• nix develop .#default --command just ci-checks
• 323 workspace tests passed; 6 explicitly skipped
• 90 deadcat-rfq-provider tests passed
• strict Clippy with warnings denied
• formatting, doc tests, and WASM check passed

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}