cow: cleave the cow venue from the composable-cow keeper

[mfw78]

What

Splits crates/cow-venue in two: the venue keeps only the orderbook (OrderBody, the borsh codec, classification, client); a new composable-cow crate takes ComposableBody, the structured poll seam (Verdict, LegacyRevertAdapter, IConditionalOrder), and everything ComposableCoW-specific. The Composable variant drops from CowIntent. shepherd-sdk's cow module and twap-monitor now import poll types from composable-cow instead of re-exporting them off the venue. Adds a blocking CI gate (check-cow-orderbook-only.sh) that scans crates/cow-venue for composable symbols and fails if any leak in. Goldens regenerated to drop the composable vectors.

Why

The CoW venue contract is the orderbook alone: submit, quote, status, cancel, and orderbook-error mapping, with zero knowledge of ComposableCoW, getTradeableOrderWithSignature, revert selectors, or TWAP. Mixing the composable keeper into the venue crate meant a new CoW keeper couldn't be written without dragging in composable machinery. This is a pure-Rust re-split with no contract dependency, so it lands ahead of the ADR-0013 poll wire-swap.

Closes #395

Testing

• cargo fmt --all --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo nextest run for cow-venue, composable-cow, shepherd-sdk, twap-monitor (85 passed)
• scripts/check-cow-orderbook-only.sh passes locally

AI Assistance

Implemented with Claude Code.

[lgahdl]

Clean, well-executed split — unlike the similar zero-leak scripts in #432/#449/#450, this one gets the polarity right (rg match -> fail, no match -> pass) and its symbol list uses the CURRENT names of what actually moved out, correctly scoped to crates/cow-venue only (doesn't false-fail on composable-cow's own legitimate use of these symbols). Split completeness verified too: cow-venue no longer imports ComposableBody, CowIntent lost the Composable variant, and every downstream consumer (shepherd-sdk, twap-monitor) imports poll types directly from composable-cow with no leftover stale re-export path. Goldens/vectors were correctly updated, including the trailing-bytes failure vector switching from Composable(...) to Order(...) so it still exercises the failure path.

One gap in the gate itself:

[lgahdl]

This pattern omits bare Verdict — the structured poll seam type this very PR's lib.rs re-exports (pub use poll::{IConditionalOrder, LegacyRevertAdapter, Verdict};) and that's used throughout the codebase as composable_cow::Verdict. A stray use composable_cow::Verdict; (or a local re-export) landing back in cow-venue wouldn't match any of composable|getTradeableOrder|IConditionalOrder|LegacyRevertAdapter|OrderNotValid|PollTry*|PollNever, so this "zero-leak" gate would report a clean pass on that specific leak. Worth adding \bVerdict\b to the pattern.

[mfw78]

Confirmed and fixed at 69a18ea. Verified your premise first: composable-cow/src/lib.rs:15 does re-export it (pub use poll::{IConditionalOrder, LegacyRevertAdapter, Verdict};), and composable_cow::Verdict is used in four files across shepherd-sdk and shepherd-sdk-test, so a stray import landing back in cow-venue was genuinely invisible to the gate.

Added \bVerdict\b to the symbols list, placed next to IConditionalOrder and LegacyRevertAdapter so the pattern mirrors that re-export line.

Two things I checked rather than assumed. The gate greps with rg -in, so a case-insensitive Verdict would false-fail on any prose use of the word: there are zero occurrences of "verdict" in any case under crates/cow-venue, so widening the pattern is safe. And since you noted on #520 that a bite-test claim is not verifiable from a diff, here is the actual sequence, run three times against the pushed head:

• clean tree: [cow PASS] cow-venue symbol scan empty
• after appending use composable_cow::Verdict; to crates/cow-venue/src/lib.rs: [cow FAIL] composable symbols leak into crates/cow-venue, naming the injected line
• after reverting: [cow PASS] again

On placement, since there is a queue of cars behind this one: the gap survives to the end of the train unchanged (the tip's shepherd/scripts/check-cow-orderbook-only.sh:21 has a byte-identical symbols line), and of every open car only this one and the M5 grouping car touch the file, the latter only relocating it. So fixing it here costs no ripple conflicts across the twelve M4 cars behind it, and the relocation carries the corrected pattern forward.