feat(extension): add clear-signing manifest review

[lukachi]

Summary

PR 8 of 9 in the tx-manifest merge train, stacked directly on #16.

• project each completed manifest review into a provenance-aware confirmation model
• show the acting account, pre-approval fee estimate, per-asset wallet balance changes, covenant verification, protocol/action/summary attribution, and hidden or published amount decisions
• serialize bigint amounts only at the extension message boundary
• add a dedicated extension renderer with deep runtime payload validation and a denial-only fallback for malformed same-kind data
• gate the new renderer with the extension compiler settings and focused markup tests

Trust boundary

Values retain one of four origins: verified against the network, read from the chain, computed by the wallet, or claimed by the site. Site-authored prose and names are visibly attributed; malformed confirmation data cannot expose an approval action.

The fee shown here is a conservative pre-approval model inherited from the completed cumulative implementation. This slice deliberately does not sign merely to calibrate it; exact-module signing and charged-fee handling remain in the final integration slice.

Deliberate exclusions

This PR does not change the process method, register the renderer, acquire credentials, sign or finalize a transaction, broadcast, activate the RPC method, change the release, or repair the accepted repository-wide dependency-family debt. PR 9 owns those cumulative activation concerns.

The committed smplx submodule pointer remains 8f0215c.

Verification

• bun run typecheck:packages
• bunx tsc -p apps/extension/tsconfig.confirmation.json
• bun --filter=./apps/web run typecheck:tooling
• bun test packages/tx-manifest — 533 pass
• renderer tests — 35 pass
• web tests — 80 pass
• assembler tests — 55 pass
• exact committed smplx pin, isolated CI test selection — 739 pass, 0 fail
• exact committed smplx pin adapter and confirmation typechecks
• bun run lint — no errors; existing warnings only
• bun run format:check
• direct web Vite production build