Settlement: provider-recourse task escrow, consume replay guard, live mainnet metering loop

[mizuki0x]

Summary

On-chain settlement of agent work, hardened and taken live.

Program (agent-os/programs/settlement)

• Task-escrow trust-model redesign (fixes the client-only-release flaw where an honest provider could be made to work for free). New state machine: FUNDED → SUBMITTED → RELEASED/REFUNDED/DISPUTED.
  • submit_result (provider) starts a challenge window; claim_task lets the provider claim after the window with no dispute — the provider recourse the old design lacked.
  • dispute_task (client, in-window) locks funds for resolve_task (arbiter = config.authority) — a client can no longer unilaterally claw back a delivered result.
  • release_task retained as a voluntary client fast-pay; refund_task restricted to FUNDED-only after deadline.
• consume_credits replay guard: a [b"receipt", owner, receipt_hash] marker PDA makes credit consumption idempotent on-chain; close_receipt reclaims the rent post-settlement.
• No Config layout change → no migration. Escrow stays behind the task-escrow feature.

Tests

• 37 litesvm tests green (with --features task-escrow) + default build green. New tests/escrow.rs covers the full state machine (claim-after-window, dispute→resolve both ways, window/deadline/provider-mismatch failures) and on-chain replay rejection.

Live on mainnet (no program upgrade — already-deployed instructions)

• Provisioned the operator credit account and proved the full metering loop atomically: open_credit_account → buy_credits → consume_credits → anchor_receipt_batch.
• Tx: 4bT7Wm2GGpdjjJRcTpYPdkFKZh2SfTkxfQZ1E1j4CfDd7pHqEUnZeMRJR1ckK69sLeo8oj4yCwG5Xd4EgvWumnb6. Credit account DrawYGmd… balance 999,000; batch Dn6WXFY9… anchored.

Not in this PR (blocked)

• The mainnet program upgrade that activates the new escrow + on-chain replay guard needs a solana-verify reproducible build, which requires Docker. No container runtime is available on the build host, so the verified upgrade is staged (devnet-provable) but not broadcast — it must not replace the verified, funds-holding mainnet program with a non-reproducible build.