feat(tx-manifest): plan assets, issuance and blinding

[lukachi]

Stack

PR 5 of 9 in the tx-manifest merge train.

• Base: feature/tx-manifest-references (PR feat(tx-manifest): resolve references and classes #13)
• Next slices build on this branch.
• The final PR absorbs the complete release behavior.

What this adds

• Resolves every input and output to an explicit asset and keeps each asset's funding arithmetic separate.
• Charges the fee only in the Liquid policy asset and returns exact non-policy-asset surplus through declared change outputs.
• Selects each wallet outpoint at most once across every asset and issuance, with stable ordering for equal-value candidates.
• Excludes confidential wallet outputs from contract-action funding and reports the withheld balance with an actionable explanation.
• Derives new issuance asset, entropy, and reissuance-token ids from the exact wallet outpoint reserved for the issuing input.
• Refuses reissuance, zero/negative issuance, nonzero reissuance-token issuance, covenant-sourced issuance, and issuance without a usable explicit wallet output.
• Verifies the TypeScript issuance derivation against known Liquid assets and against the real smplx WASM binding.
• Applies output, document, and network blinding precedence; keeps covenant/data outputs explicit; and records the deliberate open-change override needed by later contract actions.
• Passes blinding keys only to outputs the review marked hidden and refuses hidden outputs when no key is available.
• Extends the existing reviewed-plan and injected-finalizer assembler seam without acquiring credentials, signing, or broadcasting.
• Refuses a spent covenant whose explicit amount or asset cannot be established instead of treating unknown value as zero.

Review boundaries

This slice deliberately does not add:

• expression evaluation, semantic/equivalence completion, malformed-manifest guards, or validation actions;
• developer tooling and corpus-wide inspection;
• confirmation rendering or clear signing;
• covenant-spend satisfaction or activation;
• credentials, signing, broadcast, release wiring, or restoration of the full root gate.

Those remain in later stacked PRs.

Verification

Verified from commit 68457f1 in a clean detached worktree with the committed submodules:

• LWK 693c4fb
• smplx 8f0215c, SDK package 0.0.10
• frozen dependency install
• bun run typecheck:packages
• focused strict TypeScript check for the smplx adapter
• bun run lint (exit 0; existing repository warnings only)
• bun run format:check
• bun test packages/tx-manifest apps/extension/src/core/chains/liquid/adapters/smplx
• 348 tests passed, 0 failed

The real-WASM suite includes the production addWalletIssuanceInput(..., undefined) issuer-contract path and proves the binding reads omission exactly as an all-zero contract commitment.

The repository-wide TypeScript gate has the recorded pre-existing clean-install React/Zod duplicate-type baseline. This stack uses the focused tx-manifest/smplx gate until the cumulative activation/release slice restores and proves the full root check.