feat(redeem): operator attests service when a holder won't receipt (anti-grief)

[drewstone]

The grief

A holder could open a redemption, consume its inference, then refuse to sign the receipt, let the deadline pass, and claimDefault — repaid + penalty from the issuer's collateral, with the operator slashed for serving honestly. Pure griefing against an honest operator.

The fix

The operator now vouches service through the issuing book's quorum (the same quorum that minted the lot — attested redemption is bound to lotBook, so it only applies to batch-minted lots; firm settleFills lots are NO_BOOK).

• Chain client: settle_redemption_attested, finalize_attested, lot_book getter, and settle_batch_attested_with_lots (returns minted lot ids).
• Operator pump: the redeem journal records the served work commitment + timestamp; a background pump reconciles each served-but-unreceipted redemption against on-chain state via a pure, unit-tested policy (redeem_attest_action):
  • Open + holder grace elapsed + settle can still beat the deadline → self-sign receiptDigest and post settleRedemptionAttested.
  • Contested + challenge window closed → finalizeAttested.
  • Settled/defaulted/gone → drop.
  • Self-sign completes a single-attester book; an N-of-M book additionally needs peer co-signs (the call reverts and retries until quorum) — the next increment.

Verification

• settlement-e2e / e2e_anvil now proves attested redemption end-to-end on anvil WITH a time-warp: quorum vouches the receipt the holder never signed, evm_increaseTime past the challenge window, finalizeAttested settles — liability freed, no default. (Contract path also forge-tested in Redemption.t.sol.)
• redeem_attest_action unit test covers Attest / Wait (grace) / Wait (deadline-margin) / Wait (nothing served) / Finalize / Wait (window open) / Drop.
• operator 20 tests pass; chain + zk crates build; e2e PASS.

Notes

• The pump self-signs with the operator's attester key; honest by construction (the holder still has the on-chain challenge window — challengeAttested — to void a false claim, backed by the operator's slashable bond).
• Cherry-picked clean onto current main (merged with the new SURPLUS_ATTESTER_ONLY venue field).