Fix swap quote row selection and close TAO→BTC crown loophole

[anderdc]

Fixes #393 and #396.

Summary

Two related fixes in the quote / scoring pipeline. Both were exploitable by miners posting sentinel rates that won't actually serve users.

#393 — alw swap quote row selection

• Direction-aware sort. quote.py was sorting reverse=True unconditionally. Correct for BTC→TAO (higher rate = better user price); wrong for TAO→BTC, where lower TAO/BTC is the better price. The fix matches the pattern already used by swap now (swap.py:773) and validator crown (scoring.py:567).
• False global bounds abort. The up-front bounds check sampled available[0]'s rate to derive the TAO leg and aborted with "No miner can accept this" when it failed. For BTC→TAO the TAO leg depends on the miner's rate, so a single sentinel top row (e.g. 1.797e+308) was hiding viable lower rows like UID 189. Per-miner viability already covers the bounds check; an aggregate end-of-table hint preserves the "Decrease/Increase --amount" cue when every routable miner fails the same bound.
• Sentinel-rate rows mislabeled available. is_executable_rate (the predicate from PR Filter unexecutable rates from crown eligibility #395) is now consulted per row in the quote table so sentinel BTC→TAO rates render as unexecutable rate, not available.
• Best-miner hint skips unexecutable rows so the "Best miner UID X can fulfill up to Y" line doesn't cite a sentinel-rate row.

#396 — TAO→BTC crown loophole

PR #395 closed BTC→TAO sentinel rates from earning crown but explicitly left TAO→BTC open. The code and tests documented this gap:

# allways/utils/rate.py (before)
# The asymmetric griefing case — extremely low rate producing an
# unfulfillable BTC payout — is an economic-backing concern, not a
# granularity one, and is out of scope for this predicate.

# tests/test_rate.py (before)
def test_tao_to_btc_lowball_rate_passes_predicate(self):
    """... outside this predicate — documented so reviewers know the gap."""
    assert is_executable_rate(1e-8, 'tao', 'btc', self.MIN, self.MAX) is True

A miner posting r=1e-8 TAO/BTC was winning the lowest-rate-wins TAO→BTC crown every block without ever serving a swap.

This PR closes the gap with a symmetric inverse check: for TAO→BTC, treat 1/r as if it were a BTC→TAO rate and apply the same integer-overshoot logic. If 1/r's smallest positive sat would overshoot max_swap_rao, the original rate is sentinel-low by symmetry. Concretely with current SN7 bounds (min_swap=0.1 TAO, max_swap=0.5 TAO):

r (TAO/BTC)	inverse direction integer-routable?	predicate
339.62 (sane)	yes (min_source=3.39e9 sat, max_source=1.7e10 sat)	✓ executable
1000 (sane)	yes (min=1e10, max=5e10 sat)	✓ executable
2e-8 (boundary)	yes (1 sat at inverse maps to exactly max_swap)	✓ executable
1e-8 (live evidence)	no (1 sat overshoots max_swap on TAO leg)	✗ rejected
1.797e+308 (BTC→TAO sentinel)	n/a — caught by the existing BTC→TAO branch	✗ rejected

The check is policy-free — it uses only min_swap / max_swap, which validators already agree on — and consistent with #395's posture: it's the same kind of integer-overshoot guard, applied symmetrically to the other direction.

What this does NOT change

• Contract / validator-reserve still accept reservations at these rates. Closing the protocol-level exposure asymmetry would need a destination-side cap or rate floor in the contract; that's out of scope.
• User funds were never directly at risk: on TAO→BTC timeout the slash returns the TAO source leg to the user, so they're whole on principal. The exploit was about crown gaming and CLI trap-laying, not direct theft.

Files changed

• allways/utils/rate.py — is_executable_rate now gates both directions symmetrically; docstring rewritten; the gap-documenting comment block is gone.
• allways/cli/swap_commands/quote.py — direction-aware sort, removed sample_pair abort, per-row is_executable_rate, aggregate bounds hint, unexecutable-aware best-miner hint.
• tests/test_rate.py — flipped test_tao_to_btc_lowball_rate_passes_predicate → test_tao_to_btc_lowball_rate_rejected; added 4 new boundary tests for the symmetric TAO→BTC branch.
• tests/test_swap_quote.py (new) — CliRunner-driven regressions: sentinel top row doesn't hide a viable lower row; sentinel row labeled unexecutable; aggregate "decrease --amount" hint; TAO→BTC ascending sort; TAO→BTC sentinel-low labeled unexecutable.

Test plan

• pytest tests/test_rate.py — 52 passed (4 new TAO→BTC boundary tests)
• pytest tests/test_swap_quote.py — 5 passed (new file)
• pytest tests/test_scoring_v1.py — 117 passed (crown gating unaffected for sane rates)
• Full suite (excluding pre-existing embit-module failures unrelated to this PR): 564 passed
• ruff check clean