feat(venue-sdk): add nexum-venue-sdk crate

[mfw78]

What

Adds crates/nexum-venue-sdk, the venue-side SDK that generates the
nexum:adapter/venue-adapter world bindings once in-crate (bindings.rs,
via wit_bindgen::generate! with pub_export_macro: true and an
additional PartialEq derive) and layers the following on top:

• The VenueAdapter trait (adapter.rs), mirroring the world's export
  face (init, derive_header, submit, status, cancel), plus
  export_venue_adapter! to turn an impl into the component's export
  glue for the adapter's cdylib.
• The borsh IntentBody codec (body.rs): the IntentBody trait and
  typed BodyError (Empty, UnknownVersion { version },
  Malformed { version, detail }), wire form is the borsh enum layout
  (one-byte tag = declaration index, then the borsh payload).
• #[derive(IntentBody)] in crates/nexum-macros (intent_body.rs,
  wired into lib.rs), re-exported at the SDK root, generating the
  tag/version handling so an unknown tag decodes as the typed
  BodyError::UnknownVersion rather than a stringly borsh error.
• The typed intent client core (client.rs): IntentPool as the
  byte-level seam and IntentClient<P> binding one venue, encoding
  request/response bodies through IntentBody.
• Typed transport wrappers and fault conversions (transport.rs,
  faults.rs): From<host::Fault> for Fault, From<host::Fault> for VenueError, and From<nexum_sdk::http::FetchError> for VenueError.
• Crate-level integration tests (tests/adapter.rs).
• Root Cargo.toml: adds the crates/nexum-venue-sdk member, hoists
  borsh to a workspace dependency; Cargo.lock updated accordingly.

Why

Venues need a typed, borsh-backed intent codec and a thin adapter trait
over the nexum:adapter/venue-adapter world so integrations get
compile-time contract checking against the WIT definitions instead of
stringly decode errors, and an unknown intent-body version fails
cleanly as a typed BodyError rather than an opaque borsh error.

Testing

All gates run inside nix develop (rustc 1.94.0), --locked. No wit/
changes in range, so the wasmtime bindgen smoke-compile requirement does
not apply.

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace

Adversarial red-team review found no blocking or fixable defects: every
generated type matches the WIT contracts field-for-field, fold arms are
exhaustive where claimed (with non_exhaustive wildcards only where
required), and the derive's tag/version handling is sound, including the
256-variant boundary.

AI Assistance

Claude (Opus) used for the implementation.

Closes #230

[lgahdl]

Clean SDK design and good test coverage overall. Three items below.

[lgahdl]

Same purity-claim gap as PR #249 — this doc says "Must be a pure derivation: no transport, no side effects" but the venue-adapter world unconditionally imports nexum:host/chain and nexum:host/messaging, so nothing in the WIT or the generated export shim prevents derive_header from calling them. The host router calls derive_header before running the guard, so any side effects happen before policy runs.

Suggested change

	/// Project an opaque intent body onto the stable header guard
	/// policy runs on. Must be a pure derivation: no transport, no side
	/// effects, so the host can inspect a header before deciding to
	/// Project an opaque intent body onto the stable header guard
	/// policy runs on. By convention a pure derivation — no transport, no
	/// side effects — so the host can inspect a header before deciding to
	/// submit; the WIT cannot enforce this, as chain and messaging imports
	/// remain available inside `derive-header`.
	fn derive_header(body: Vec<u8>) -> Result<IntentHeader, VenueError>;

[lgahdl]

"carries no Display" is inaccurate. VenueError appears in the error slot of all four nexum:intent/adapter results, so wit-bindgen 0.58 sets TypeInfo::error = true and generates impl Display for VenueError (delegates to Debug). The {0:?} format is still correct — the generated Display and Debug produce the same output — but the stated reason is wrong.

Suggested change

	/// The pool or the venue behind it failed the call. The payload is
	/// the wire `venue-error`, which carries no `Display`; format via
	/// `Debug`.
	/// The pool or the venue behind it failed the call. The wire
	/// `venue-error`'s generated `Display` delegates to `Debug`, so
	/// `{0:?}` gives the richer output.
	#[error("venue error: {0:?}")]
	Venue(VenueError),

[lgahdl]

The RateLimited arm in From<host::Fault> for VenueError silently drops retry_after_ms — the caller loses the backoff hint and gets a plain string. That's the only arm where structured data is destroyed rather than threaded through, making it the most likely regression target. Adding it to this test would catch a future refactor that accidentally routes it elsewhere:

Suggested change

	fn transport_fault_folds_to_venue_error_by_shape() {
	assert_eq!(
	VenueError::from(host::Fault::Denied("nope".into())),
	VenueError::Denied("nope".into()),
	);
	assert!(matches!(
	VenueError::from(host::Fault::Timeout),
	VenueError::Unavailable(_)
	));
	assert!(matches!(
	VenueError::from(host::Fault::InvalidInput("bug".into())),
	VenueError::InternalError(_)
	));
	}
	#[test]
	fn transport_fault_folds_to_venue_error_by_shape() {
	assert_eq!(
	VenueError::from(host::Fault::Denied("nope".into())),
	VenueError::Denied("nope".into()),
	);
	assert!(matches!(
	VenueError::from(host::Fault::Timeout),
	VenueError::Unavailable(_)
	));
	assert!(matches!(
	VenueError::from(host::Fault::RateLimited(host::RateLimit { retry_after_ms: Some(500) })),
	VenueError::Unavailable(_) // retry_after_ms is intentionally dropped here
	));
	assert!(matches!(
	VenueError::from(host::Fault::InvalidInput("bug".into())),
	VenueError::InternalError(_)
	));
	}