feat(cketh): add the SweeperFunding withdrawal-request variant [override-didc-check]

[mbjorkqvist]

Part of DEFI-2933 (sweeper fee funding), third of a seven-PR stack. Targets #11065.

Why

Sweeper fee funding is mechanically an ordinary ckETH withdrawal — same nonce sequence, same threshold-ECDSA signing, same fee-bumped resubmission — so it becomes a third WithdrawalRequest variant rather than a parallel pipeline.

It differs in exactly one respect, and that difference is what the whole feature turns on: the ckETH burned for funding is never re-minted. A funding request must therefore never reach the reimbursement machinery.

What

Three places enforce that, all of which would otherwise fail only at runtime:

• maybe_reimburse is the double-minting guard, and record_reimbursement_request asserts membership has been cleared before minting. Funding is kept out of the set on insert, and the corresponding assertion on removal is made conditional. Both are production assertions, so a missed branch traps the canister.
• The conversion to a reimbursement index becomes fallible, deliberately: a fallible conversion makes the compiler prove at every call site that funding cannot produce an index, rather than relying on a panicking arm that traps if a site is missed. The two callers construct their index inside the reimbursable arms instead.
• A failed funding transaction records nothing to pay back, only a log line. Everything a later funding needs in order to offset against the unspent burn is reconstructible from the accepted-request event plus the finalized transaction's receipt, so no second event type is introduced.

Everything else follows ckETH: the 21'000 gas limit of a plain value transfer to a code-less address, a resubmission strategy ceilinged at the burned amount — so a climbing gas price shrinks the ETH delivered to the sweeper rather than spending more than was burned — and a fee carved out of that same amount, so balance accounting needs no change.

Funding appears in the withdrawal status endpoint, the dashboard and the event log rather than being hidden: it moves ckETH-denominated value and is a public, auditable action. A user query never matches one, since the sender is the minter itself.

Tests pin the difference, including a deliberate contrast test asserting that a failed user withdrawal is still reimbursed — without it, the no-reimbursement tests would also pass if reimbursement were broken for everything. The fee ceiling is asserted through behaviour rather than by inspecting stored state, and the new event tag round-trips as CBOR.

Stack

Merge in order; each PR targets the one above it.

#	PR	Status
1	#11060 — Read a native ETH balance via the EVM RPC canister	Copilot clean, CI green
2	#11065 — Burn ckETH from the minter's own fee subaccount	Copilot clean, CI green
3	Add the SweeperFunding withdrawal-request variant	this PR
4	Burn-first accounting for sweeper fee funding	not yet opened
5	Sweeper fee-funding task, with an end-to-end test	not yet opened
6	Sweeper funding observability and the prepaid-gas gate	not yet opened
7	Adversarial end-to-end coverage of sweeper fee funding	not yet opened