venue: reconcile-contract compliance suite

[mfw78]

What

Add the venue reconcile contract that the durable-effect sweep will lean on. A sealed marker trait VenueReconcile in videre-sdk states the per-adapter obligation, a shared venue_reconcile_compliance! macro in videre-test proves it, and the CoW adapter instantiates it.

The contract has a mandatory floor and an optional fast-path. Floor: submit(body) for a body the venue already holds resolves to SubmitOutcome::Accepted with the same receipt, and a held body never surfaces as a terminal VenueFault. Fast-path: an adapter may expose a body-derivable receipt so a reconcile can status(receipt) first and commit without a redundant POST.

Reconcile trusts venue-side order validity: it does not re-poll the watch source, so the contract requires adapters to carry self-describing order validity (for CoW, validTo and the limit price).

Why

Exactly-once across the external submit is impossible from the SDK alone. The residual is closed only by the venue recognising a re-sent order as the same order. CoW already discharges this implicitly by folding an orderbook duplicate to AlreadyHeld then Accepted with the client-derived UID. This generalises that into an explicit, tested contract every adapter must satisfy before a reserve-writing sweep can drive it.

Testing

Pure trait, macro, test and doc over existing behaviour; no runtime behaviour change. cargo fmt --all -- --check, cargo clippy --workspace --all-targets --all-features --locked -D warnings, all 17 guest wasms, cargo nextest run --workspace --all-features --locked (the CoW compliance suite passes: re-POST idempotency on both auth paths, held-never-faults, 404-retryable), cargo test --doc, RUSTDOCFLAGS=-D warnings cargo doc --workspace --no-deps --locked, scripts/check-venue-agnostic.sh, scripts/check-cow-orderbook-only.sh.

AI Assistance

Implemented with Claude Code.

Closes #574