sdk-go/stress: refuse CreateUser under RFC-27 enforcement and name the proof errors

[elitegreg]

Closes #4225. Part of RFC-27 (rfcs/rfc27-ip-verification.md, tracker #4194).

Stacked on #4243 — based on gm/e2e-ip-proof-enforcement. Must not merge before it. The diff shown here is against that branch.

Decision: option B, gate the tool

The issue offered two paths and recommended B. Two independent findings confirm it:

• The addresses cannot be proven. The verifier signs only the address it observes a request originate from (crates/doublezero-ip-verifier/src/server.rs, resolve_client_ip). Executor.CreateUser's one production consumer is the device-stress orchestrator, whose addresses are ClientIPBase + idx — synthetic, and not addresses it originates traffic from. Binding an address the caller does not control is the exact thing RFC-27 exists to prevent, so porting the proof path would mean inventing a bypass for it.
• The account layout has no room. genericInstruction.skipPermissionInject exists because the processor detects the optional tenant account by accounts.len(). Appending an Instructions sysvar account — which a proof requires — shifts that count and mis-classifies accounts.

Summary of Changes

• CreateUser refuses when require-ip-ownership-proof is set, with a message naming the flag and what to do instead, rather than spending a transaction per user to collect IpOwnershipProofRequired (105). The flag is read from GlobalState once and cached behind a sync.Once, like the existing Permission PDA lookup. A failure to read global state warns and proceeds — the program is the authority on enforcement, and an unreadable account is not grounds for refusing to submit anything.
• The ip_proof discriminant is emitted explicitly (12 → 13 bytes), so the Go payload equals the Rust user_create_args fixture byte for byte. TestBuildCreateUserInstruction drops its "minus the discriminant" exception. Relying on BorshDeserializeIncremental to default the field left the assertion unable to tell an intentionally absent proof from a truncated payload.
• Named errors for the RFC-27 rejection classes. The custom-error map stopped at 90, so every RFC-27 rejection rendered as unknown error code 105. Codes 91–118 gained names, and ClassifyProgramError annotates a transaction error with a comparable ProgramError so callers can match it with errors.Is; Unwrap() []error keeps the original jsonrpc.RPCError reachable.
• CLAUDE.md no longer describes the Go SDK as read-only.

A pre-existing bug found on the way, deliberately not fixed here

ByteReader.ReadU128 assigns Uint128.High from the first eight encoded bytes, but Borsh writes a u128 little-endian — those are the low half. Confirmed against the fixture: global_state.json has AccountIndex: 42 and global_state.bin encodes it as 2a 00 00 … in the first eight bytes, which land in .High. The two fields are named the wrong way round.

No production Go reads .High/.Low — only the deserializer writes them — but client_test.go bakes in the swapped convention (Uint128{High: 12, Low: 0}), so correcting it touches those tests and belongs in its own change. This PR isolates the wart behind a documented Uint128.Lo64() accessor and does not rename anything. Worth its own issue.

Testing Verification

• TestBuildCreateUserInstruction now asserts the full Rust fixture with no trailing-byte exception.
• TestCreateUserRefusesWhenProofRequired: with the flag set, nothing is submitted (sentTransactions empty), the derived user PDA is still returned so a caller can correlate the refusal, and a second attempt re-uses the cached flags rather than re-reading global state.
• TestCreateUserProceedsWhenProofNotRequired: with the flag clear, the create is submitted — so the guard cannot pass by refusing everything.
• TestGlobalStateIsFeatureEnabled round-trips through the real deserializer rather than constructing a Uint128 by hand, and checks that bit 1 is not mistaken for bit 2.
• TestClassifyProgramErrorMapsIPOwnershipProofRequired asserts the named match, the absence of a match against a sibling class, and that the underlying jsonrpc.RPCError survives.
• Whole-repo go build ./... and the full smartcontract/sdk/go/... plus tools/stress/... suites pass; golangci-lint reports 0 issues on the changed package.