serviceability-instruction: user domain builders (RFC-26 R3)

[juan-malbeclabs]

Summary

RFC-26 R3 (stacked on the previous phase's branch). create_user (length-detected -> build, no permission), update_user, delete_user, request_ban_user, check_user_access_pass, and set_user_bgp_status (metrics-publisher check, no authorize -> build).

All builders route through authorize() -> build_with_permission unless noted; each carries a verbatim account-layout doc-comment copied from its processor.

Testing Verification

• Unit tests assert the exact AccountMeta list (incl. trailing [payer, system]) and the borsh tag byte for every builder, covering the conditional/variable-account paths.

Closes #4018. Part of RFC-26 (rfcs/rfc26-rust-instruction-builder-library.md).

---

PR stack (RFC-26 builder library)

Stacked PRs, merge in order (each is based on the previous one's branch):

1. serviceability-instruction: scaffold pure instruction-builder crate (RFC-26 R0) #4049 — R0 scaffold + exemplars
2. serviceability-instruction: device domain builders (RFC-26 R1) #4050 — R1 device
3. serviceability-instruction: link domain builders (RFC-26 R2) #4051 — R2 link
4. serviceability-instruction: user domain builders (RFC-26 R3) #4052 — R3 user ← this PR
5. serviceability-instruction: location/exchange/contributor builders (RFC-26 R4) #4053 — R4 location/exchange/contributor
6. serviceability-instruction: multicastgroup + allowlist builders (RFC-26 R5) #4054 — R5 multicastgroup + allowlists
7. serviceability-instruction: tenant + permission builders (RFC-26 R6) #4055 — R6 tenant + permission
8. serviceability-instruction: topology + feed builders (RFC-26 R7) #4056 — R7 topology + feed
9. serviceability-instruction: accesspass + resource builders (RFC-26 R8) #4057 — R8 accesspass + resource
10. serviceability-instruction: globalstate/globalconfig/allowlist/index/migrate builders (RFC-26 R9) #4058 — R9 globalstate/config/allowlist/index/migrate

R10 (commands/* migration + program-test) and RF (fixtures) follow as separate PRs.