feat(money): E4 · money keeps its context — holdings $/24h columns + honest hero meta (#184)

[hellno]

Implements E4 · Money keeps its context (#184), part of the v4 request-origin epic #179.

The wallet-home money surface. Honesty is the point of the ticket (DESIGN §Trust rule 9): the engine has no price feed and no 24h history, so every fiat/history slot renders an explicit —, never a fabricated number. The trust-critical verified on mainnet claim is pinned to a real verified read on chain 1.

What changed

money.rs — new money_cell: a decimal-point-aligned ledger cell. The integer is right-aligned up to a fixed 52px seam and .decimals are left-aligned after it, so points line up down a column regardless of fractional width. Mask-safe (renders MASK_BULLETS, no value/digit-count leak).

welcome.rs

• Holdings ledger rebuilt to 4 columns: Asset · Balance · 24h · $ Value (shared fixed widths for header+rows so they can't drift). Balance uses money_cell; 24h and $ Value render an honest — (no price feed) with a footnote.
• Hero meta line under the balance: $… · synced … · verified on mainnet. New pure, unit-tested VerifiedClaim::from_read — claims verified on mainnet (success/green) only for a real Helios-verified read on chain 1; a fork/testnet or unsynced read reads the loud unverified (amber). USD slot is an honest —.
• Action row left-anchored (justify_start).

shell_rail.rs — "This wallet" rail: honest Value — row + an always-on summary metasec with Connections: none (reserved/empty per ADR-0001/#44 — never a fabricated count) and explicit Agents row.

Trust invariants

• No fabricated numbers. USD hero slot, 24h, $ Value, and rail Value all render an explicit —. Never a computed/faked value.
• verified on mainnet is honest. 4 unit tests pin VerifiedClaim::from_read: mainnet+Verified→success; degraded→loud; unsynced/none→unverified; off-mainnet-even-if-spuriously-Verified→unverified (defence in depth over the registry).
• Mask still hides balances — money_cell honors masked.

Definition of Done

• cargo fmt --all --check — clean.
• just check (clippy -D warnings, default + --features tray + signerd dev-signerd-bin) — green (exit 0).
• cargo test --workspace — 421 passed, 2 ignored (incl. 4 new VerifiedClaim tests).
• No new/changed deps.
• No new user-facing action → no ⌘K command needed (all changes are display/layout; the Connections rail row is read-only reserved state).
• Adversarial review: a 4-lens review (honesty/trust · design-fidelity · GPUI-layout · codex GPT cross-model) returned 0 P0/P1; the 2 minor findings (header hairline; large-integer overflow headroom) are fixed in this PR.

Wallet-home fidelity checklist (#184)

• Sidebar top group WALLETS; Agents show handle + status; Connections group present.
• Breadcrumb is the entity name only (Meridian).
• Identity masthead: name + identity_mark above the mono hero.
• Hero mono, dimmed decimals; meta line $… · synced … · verified on mainnet with honest fallback off mainnet / no price.
• Actions left-anchored (Shield primary; Send/Receive/Swap ghost).
• Holdings: Asset · Balance · 24h · $ Value, mono, decimals aligned on the point.
• Right rail "This wallet": sync/verified/network + cap ledger + Connections/Agents kv rows.
• Waiting strip (one line) — owned by E6 (E6 · Origin-attributed Activity + "Waiting on you" #186), out of scope here.

Screenshots (before/after)

Captured live off the running app on both chains (local .context/shots/):

Fork / testnet (chain 31337 — off-mainnet honesty path) — home_fork_final.png
Hero meta reads — · synced block 0 · unverified (unverified in amber); rail Status Not verified (amber), Network Anvil (local), Value —, Connections none, Agents 1 active; holdings ETH row 10,000 · — · —; actions left-anchored.

Mainnet (chain 1 — verified path) — home_mainnet.png
Helios synced (block 25474971); hero meta reads — · synced block 25474971 · verified on mainnet (verified on mainnet in green); rail Status Verified (green), Network Ethereum; holdings ETH row 0 · — · —; USD slot —; actions left-anchored (Swap enabled on mainnet).

Note: no before shot of the home screen was possible pre-change (the wallet-home already existed), so the two after captures across mainnet + fork are the evidence; they exercise both branches of the honesty-critical VerifiedClaim logic. PNGs are in .context/shots/ for anyone driving locally (scripts/deckard-drive.sh).

Closes #184.