feat(fiscobcos): support Guomi SM2 and SM3 networks

[ryan-wong-coder]

Linked Issue

Fixes #468

Summary

• bind every FISCO BCOS trust root, transaction, receipt, PBFT proof, and signer to an explicit standard or Guomi crypto mode
• support native Guomi SM2 signing, SM3 hashing, dual-certificate transport, hardware-backed signer profiles, and fail-closed cross-mode rejection
• add canonical TrustConfig tooling, production TrustDBAnchorV1 smoke evidence, offline verification gates, and repeated same-host performance evidence

Required Format

• Branch name uses an approved feat/ prefix.
• PR title and commits use Conventional Commits.

Scope

• This PR solves one issue or one clearly scoped maintenance task.
• This PR does not include unrelated formatting, experiments, generated local data, keys, logs, backups, or build artifacts.
• User-facing documentation describes implemented behavior only.

Proof, Storage, And Compatibility

• TrustDB L1/L2/L3/L4/L5 evidence semantics are unchanged.
• L4/L5 behavior remains batch root in the Global Log and exact STH/global root anchoring.
• Existing portable evidence and backup file format versions are unchanged.
• WAL, proofstore, global log, anchor scheduler, backup, and desktop durable boundaries are unchanged.
• No production path introduces full-scan, full-load, full-sort, or full-recompute behavior.

The existing FISCO BCOS proof and attempt-journal structures gain mandatory crypto-mode binding. The project has no existing FISCO BCOS users, so no legacy cross-mode decoder or downgrade path is retained.

Validation

Validated at exact head c588b08eb91a5bc8dc3ca3331aed27c36f06904e:

• full Go unit, race, integration, E2E, benchmark-smoke, vet, Python, shell, and artifact suites
• native fiscobcos_sdk tests on macOS arm64 with the pinned C SDK
• Windows amd64 TrustConfig developer-toolchain tests
• all GitHub required checks plus PKCS11, SDF, TLCP, FISCO contract, and platform matrices
• independent whole-PR review with no P1/P2/P3 findings
• isolated Linux amd64 Standard and Guomi four-node Air validation, each with 5 warmups and 20 fresh production TrustDBAnchorV1.publish samples
• exact AnchorPublished field validation, getAnchor read-back, receipt/block consensus hashes, and 3-of-4 PBFT signatures
• Guomi SM2 dual-certificate and SM3 cross-mode negative validation

Linux evidence source identity: tree 6390a0486b9cbb53094654a56ad8c6a19764eba9, archive SHA-256 ac96c5d3a9a054c04db83d445a1c238ce969802f2f30250be7e9bb52618bd629. Evidence is retained on the isolated test host under /data/trustdb-468/results/c588b08/ with a verified SHA-256 manifest.

Risk And Rollback

Critical cryptographic and chain-integration change. Roll back by reverting this PR; standard-mode behavior remains explicitly covered, and no migration compatibility path is introduced.