refactor(twap-monitor): port poll loop onto keeper

[mfw78]

What

Ports twap-monitor off its hand-rolled poll loop onto the shared keeper composition (ConditionalSource + WatchSet), via the run loop in shepherd_sdk::cow::run, reusing the existing CowApiHost seam.

• crates/nexum-sdk/src/keeper.rs: ConditionalSource gains a defaulted label() hook (default "conditional") so shared log lines can attribute the emitting strategy.
• crates/shepherd-sdk/src/cow/run.rs: the run loop's submit-path diagnostics ("submit retry-next-block: ...", "{label} UID divergence: client=... server=...", submitted markers) now go through the guest tracing facade instead of host.log, so they are observable via capture_tracing.
• modules/twap-monitor/src/strategy.rs: shrinks from ~1140 to ~830 lines by deleting the hand-rolled poll loop (gate keys, watch-update lifecycle, submitted: markers, submit-retry dispatch, BuildError, build_order_creation, compute_uid_hex, outcome_to_update) in favour of a TwapSource: ConditionalSource<H> implementation (label() -> "twap") driven by shepherd_sdk::cow::run. The strategy's own revert-decode dispatch is also dropped in favour of the shared classify_poll_error policy. on_chain_logs now persists via WatchSet::put, and on_block builds a Tick.
• crates/shepherd-sdk/tests/run.rs: updated the run-loop integration test's log assertion to capture via capture_tracing instead of host.logging.
• crates/shepherd-sdk/Cargo.toml, modules/twap-monitor/Cargo.toml, Cargo.lock: dependency updates to support the above (tracing as a direct dependency, nexum-sdk-test dev-dependency, strum/thiserror/serde_json dropped from twap-monitor's non-dev dependencies).

Why

twap-monitor carried its own gate bookkeeping, watch lifecycle and submit-retry dispatch, duplicating behaviour the keeper composition already provides generically. Porting it onto ConditionalSource + WatchSet removes that duplication and gives twap-monitor the same submit-path diagnostics and retry policy as every other strategy running on the keeper, while label() keeps shared log lines attributable once more than one composed strategy is running.

Testing

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings (host and wasm32-wasip2)
• cargo test --workspace (twap-monitor, shepherd-sdk, nexum-sdk; wall-clock-dependent tests re-run twice)
• wasm32-wasip2 release build
• rustdoc link check

Acceptance: the MockHost dispatch tests are byte-identical to base and pass, demonstrating behavioural identity of the port. No .wit files touched, so no new WIT packages or bindgen smoke required.

AI Assistance

Claude (Opus) used for the port.

Closes #147

[lgahdl]

Clean port — the deletion of BuildError, WatchUpdate, apply_watch_update, apply_submit_retry, and all hand-rolled gate helpers is the right move. Two things worth calling out explicitly:

Behaviour change, not identity: The PR description says the acceptance tests are "byte-identical to base, demonstrating behaviour identity of the port." This is true for the success path only. poll_one now delegates to classify_poll_error, which maps any ChainError::Rpc with 4+ bytes of data that decode_revert does not recognise to DontTryAgain (permanent drop). The old code always fell back to TryNextBlock. Any live TWAP whose handler contract emits an unrecognised custom error will have its watches permanently dropped after this merge. That is the right policy direction, but it should be stated as a deliberate tightening, not subsumed under "byte-identical."

Silent bug fix: The deleted apply_submit_retry wrote Backoff gates as the raw string "next_epoch:{owner_hex}:{hash_hex}" instead of going through Gates::set_next_epoch. If that key format ever differed from what is_ready read, the backoff gate was invisible to the gating check. The new path through RetryLedger::apply -> Gates::set_next_epoch is provably consistent. Worth a sentence in the PR description.

[lgahdl]

Only transport faults are logged here; when classify_poll_error returns DontTryAgain for an unrecognised Rpc revert the watch disappears with zero diagnostic at the poll site (materialise does not log for DontTryAgain either). The old code always emitted a warn for this path — an operator has no visibility into why a TWAP watch dropped.

Consider logging for the Rpc case too after the classify_poll_error call, e.g.: if matches!(outcome, PollOutcome::DontTryAgain) { tracing::warn!("eth_call unrecognised revert for {}; dropping watch", watch.key()); }

[lgahdl]

Cross-ref for when this thread gets swept: the diagnostic half of this finding is superseded by the ADR-0013 Verdict seam (#334) — Verdict::Invalid { reason: [u8; 4] } now carries the selector that this path drops silently, and the strategy's drop diagnostic logs it. So on the train tip the watch no longer disappears with zero trace; this branch's transport-only logging is fine as an interim state.

[lgahdl]

Grammar makes this hard to parse: "compositions" should be "implementations", and "prefix ... with" inverts the normal subject-verb order.

Suggested change

	/// Short strategy name compositions prefix shared log lines with
	/// (for example `"twap"`). Diagnostic only - no behaviour keys
	/// off it.
	/// Short name that implementations return to prefix shared log lines.
	/// Diagnostic only - no behaviour keys off this value.
	/// Default: `"conditional"`.

[lgahdl]

"Row" is informal and inconsistent with the SDK's terminology (watch, WatchSet). The rest of the PR uses "watch" throughout.

Suggested change

	/// source cannot decode polls again next block rather than tearing
	/// down the sweep.
	struct TwapSource;
	/// and evaluate `getTradeableOrderWithSignature` on chain. A watch
	/// whose params cannot be decoded returns `TryNextBlock` rather than
	/// tearing down the sweep.