feat(cli): add yacd wallet verbs with direct tx submission

[jmgilman]

Phase 3 — CLI-native wallets / faucet-removal plan

Adds a yacd wallet command subtree that manages test wallets as Kubernetes Secrets and funds them by building, signing, and submitting transactions directly against Ogmios/Kupo (via internal/cardano/tx), spending from the genesis-funded faucet wallet (P2). The standalone yacd topup and its faucet-HTTP transport + token trust gate are removed and folded into wallet topup.

Verbs

• yacd wallet list NET [--json]
• yacd wallet add NET [--name N] [--topup L] [--await] — keygen → owned Secret → optional fund from faucet
• yacd wallet topup NET WALLET L [--from SRC] [--await] — fund a wallet (or raw address) from faucet/--from
• yacd wallet export NET WALLET [--out DIR] [--force] — write 0600 .skey/.vkey/.addr
• yacd wallet remove NET WALLET

WALLET is a second positional accepting a name / pubkey-hex / bech32 address (a raw address funds directly). Names come from an embedded adjective-noun wordlist (collision-checked, ~50/network ceiling).

Internals

• wallet.DecodePaymentKeyEnvelope (manager-safe) decodes the cardano-cli key envelope → raw 32-byte hex for both skey (signing) and vkey (pubkey).
• cli/internal/wallet store (labeled Secrets matching P2's yacd.meigma.io/wallet-name/wallet-source, ownerRef → the network) + name/pubkey/address selector + wordlist.
• kube.Client gains Secret CRUD/list-by-label; an injectable tx.Submitter seam makes the funding verbs unit-testable without a real chain.
• Funding self-forwards Ogmios+Kupo (loopback) via the existing forwardEndpoints; confirmation reuses the kugo path.

Manager boundary (load-bearing)

go list -deps ./cmd stays free of ogmigo/kugo/internal/cardano/tx; internal/cardano/wallet's new helper is manager-safe (cbor/json/ed25519 only). Only the CLI gains the chain-tx stack.

Verification

• moon run root:check ✅ · moon run root:test ✅ (wallet verbs + store + decode, all against mocks — --from, readiness gating, partial-failure, export edge cases, selector resolution, ceiling). gofmt/go build/go vet clean.
• Live-proven on the Kind dev stack: wallet add alice --topup 1000000000 --await had the CLI build+sign+submit a real funding tx from the faucet wallet (tx 1198bc05…, confirmed on-chain); cardano-cli query utxo showed alice holding 1,000,000,000 lovelace; wallet list showed her; wallet export wrote a valid 0600 cardano-cli .skey.

Known follow-up (not blocking)

Apollo's chain-context init logs a transient Ogmios websocket hiccup (the known ogmigo/Gorilla-WS behavior) during funding; the tx still succeeds. Worth quieting/handling later.

Plan context

Phase 3 of 5. Next: P4 (cut over devnet/dev-wallet funding to the CLI, then delete the in-cluster faucet service + spec.chainAPI.{faucet,wallet}).

🤖 Generated with Claude Code

[jmgilman]

Full manual functional test (Kind dev stack) — done, with fixes

Ran the complete yacd wallet surface against a live local faucet network. Everything works, including the end-to-end key story (real cardano-cli derives the same address from an exported vkey and round-trips skey↔vkey), cross-wallet funding with exact balance math, all three selector forms (name / pubkey / address), and the faucet-gate on a faucet-less network.

Found and fixed 4 UX issues (commit c765310), each re-validated live:

1. --json was broken on funding — Apollo's OgmiosChainContext.GenesisParams does a hardcoded fmt.Printf to stdout on a non-fatal genesis-config fetch hiccup, corrupting wallet topup/add --json. Now routed to stderr; --json stdout is clean valid JSON.
2. Invalid wallet name now validated as a DNS-1123 label up front (clear error vs a raw Kubernetes label-validation message).
3. export of a missing wallet now says wallet "X" not found (was leaking the Secret name).
4. remove of a missing wallet now says wallet "X" not found (was a misleading "Removed").

Added test coverage for the new validation + not-found paths. root:check/root:test green.