feat(venue-sdk): add nexum-venue-sdk crate

[mfw78]

Summary

Ships crates/nexum-venue-sdk (single commit 34077c1), the venue-side SDK
that generates the nexum:adapter/venue-adapter world bindings once
in-crate and layers the VenueAdapter trait, the borsh IntentBody
codec, and the typed intent client core on top.

Closes #230

Changes

• Add crates/nexum-venue-sdk (new workspace member): generates the
  nexum:adapter/venue-adapter world bindings once, in bindings.rs, via
  wit_bindgen::generate! with pub_export_macro: true and an
  additional PartialEq derive.
• Add the VenueAdapter trait (adapter.rs) mirroring the world's export
  face (init, derive_header, submit, status, cancel), plus
  export_venue_adapter! which turns an impl into the component's export
  glue for the adapter's cdylib.
• Add the borsh IntentBody codec: the IntentBody trait and typed
  BodyError in body.rs (Empty, UnknownVersion { version },
  Malformed { version, detail }), with the wire form being the borsh
  enum layout (one-byte tag = declaration index, then the borsh payload).
• Add #[derive(IntentBody)] in crates/nexum-macros (intent_body.rs,
  wired into lib.rs), re-exported at the SDK root, generating the
  tag/version handling so an unknown tag decodes as the typed
  BodyError::UnknownVersion rather than a stringly borsh error.
• Add the typed intent client core (client.rs): IntentPool as the
  byte-level seam and IntentClient<P> binding one venue, encoding
  request/response bodies through IntentBody.
• Add typed transport wrappers and fault conversions (transport.rs,
  faults.rs): From<host::Fault> for Fault, From<host::Fault> for VenueError, and From<nexum_sdk::http::FetchError> for VenueError.
• Add crate-level integration tests (tests/adapter.rs).
• Root Cargo.toml: add the crates/nexum-venue-sdk member and hoist
  borsh to a workspace dependency; Cargo.lock updated accordingly.

Test plan

Independent verification of feat/m1-venue-sdk (single commit 34077c1,
stacked on origin/feat/m1-pool-router), all gates run inside nix develop (rustc 1.94.0), warm target, --locked. No wit/ changes in
range, so the wasmtime bindgen smoke-compile requirement does not apply.

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace

Notes for reviewer

Adversarial red-team of this PR found no blocking or fixable defects:
every generated type matches the WIT contracts field-for-field, fold arms
are exhaustive where claimed (with non_exhaustive wildcards only where
required), and the derive's tag/version handling is sound, including the
256-variant boundary.

Stacked on feat/m1-pool-router; merges bottom-up after the fault train
lands; retarget to develop then.

[lgahdl]

Clean SDK design and good test coverage overall. Three items below.

[lgahdl]

Same purity-claim gap as PR #249 — this doc says "Must be a pure derivation: no transport, no side effects" but the venue-adapter world unconditionally imports nexum:host/chain and nexum:host/messaging, so nothing in the WIT or the generated export shim prevents derive_header from calling them. The host router calls derive_header before running the guard, so any side effects happen before policy runs.

Suggested change

	/// Project an opaque intent body onto the stable header guard
	/// policy runs on. Must be a pure derivation: no transport, no side
	/// effects, so the host can inspect a header before deciding to
	/// Project an opaque intent body onto the stable header guard
	/// policy runs on. By convention a pure derivation — no transport, no
	/// side effects — so the host can inspect a header before deciding to
	/// submit; the WIT cannot enforce this, as chain and messaging imports
	/// remain available inside `derive-header`.
	fn derive_header(body: Vec<u8>) -> Result<IntentHeader, VenueError>;

[lgahdl]

"carries no Display" is inaccurate. VenueError appears in the error slot of all four nexum:intent/adapter results, so wit-bindgen 0.58 sets TypeInfo::error = true and generates impl Display for VenueError (delegates to Debug). The {0:?} format is still correct — the generated Display and Debug produce the same output — but the stated reason is wrong.

Suggested change

	/// The pool or the venue behind it failed the call. The payload is
	/// the wire `venue-error`, which carries no `Display`; format via
	/// `Debug`.
	/// The pool or the venue behind it failed the call. The wire
	/// `venue-error`'s generated `Display` delegates to `Debug`, so
	/// `{0:?}` gives the richer output.
	#[error("venue error: {0:?}")]
	Venue(VenueError),

[lgahdl]

The RateLimited arm in From<host::Fault> for VenueError silently drops retry_after_ms — the caller loses the backoff hint and gets a plain string. That's the only arm where structured data is destroyed rather than threaded through, making it the most likely regression target. Adding it to this test would catch a future refactor that accidentally routes it elsewhere:

Suggested change

	fn transport_fault_folds_to_venue_error_by_shape() {
	assert_eq!(
	VenueError::from(host::Fault::Denied("nope".into())),
	VenueError::Denied("nope".into()),
	);
	assert!(matches!(
	VenueError::from(host::Fault::Timeout),
	VenueError::Unavailable(_)
	));
	assert!(matches!(
	VenueError::from(host::Fault::InvalidInput("bug".into())),
	VenueError::InternalError(_)
	));
	}
	#[test]
	fn transport_fault_folds_to_venue_error_by_shape() {
	assert_eq!(
	VenueError::from(host::Fault::Denied("nope".into())),
	VenueError::Denied("nope".into()),
	);
	assert!(matches!(
	VenueError::from(host::Fault::Timeout),
	VenueError::Unavailable(_)
	));
	assert!(matches!(
	VenueError::from(host::Fault::RateLimited(host::RateLimit { retry_after_ms: Some(500) })),
	VenueError::Unavailable(_) // retry_after_ms is intentionally dropped here
	));
	assert!(matches!(
	VenueError::from(host::Fault::InvalidInput("bug".into())),
	VenueError::InternalError(_)
	));
	}