keeper: reserve/commit journal with top-of-sweep reconcile

[mfw78]

What

Adds a reserve/commit journal to the keeper sweep. On each sweep, pending reservations left RESERVED but not COMMITTED are reconciled via the venue idempotency key rather than skipped or blindly resubmitted. Journal::pending is exposed as an operator enumerate surface for a poisoned or quarantined module.

Why

A reserve marker with no matching commit is ambiguous: it can mean the submit was accepted but the commit write faulted, or the process crashed or was cancelled mid-submit. Skipping it silently drops an order a slow venue deadline-cancelled; resubmitting it risks a duplicate. Only the venue can resolve that, so reconciliation belongs at the top of the sweep, keyed on the reservation, not in a post-submit release call that no crash, trap, or OutOfFuel path reaches.

Testing

Full battery, all green in /code/nxm/wt-m4-573d:

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo build --release --target wasm32-wasip2 --locked (16 modules, then cow-venue/adapter separately); wasm count asserted at 17
• cargo nextest run --workspace --all-features --no-fail-fast --locked (822 run, 822 passed, 1 skipped; new w1/w2/w3 + anti_572 cases pass)
• cargo test --doc --workspace --all-features --locked
• RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps --locked
• scripts/check-venue-agnostic.sh
• scripts/check-cow-orderbook-only.sh

AI Assistance

Implemented with Claude Code.

Completes the reserve/commit/reconcile chain at L3, after #583 (journal API), #584 (venue idempotency contract) and #586 (keeper rewire). Refs #573.