feat(rfq): bind taker journal to wallet state

[tvolk131]

Summary

• derive a stable, opaque wallet-instance ID that survives authenticated backup/restore while distinguishing independently created wallets
• persist an immutable execution-journal binding over the state bundle, wallet instance, taker endpoint, chain, and policy asset
• require the exact expected binding when reopening a journal, including for an empty journal
• enforce the journal's execution identity on arm, load, pagination, and observation updates
• make taker recovery validate the journal binding before inventory is exposed, and retain that wallet provenance across refresh and pending-execution scans
• update the client, taker, and live provider-process fixtures to construct the bound journal explicitly

Safety properties

• replacing the journal with a valid empty journal from another bundle or wallet fails closed instead of silently forgetting durable input exclusions
• a journal cannot accept or return attempts for another taker endpoint, chain, or policy asset
• a runtime cannot pair an existing journal with a separately generated wallet that uses the same application identity
• wallet-instance derivation is domain-separated, redacted in debug output, backup-stable, and pinned by a compatibility vector
• binding is explicitly documented as generation identity rather than freshness proof; coordinated backup/restore and same-generation rollback protection remain responsibilities of the future runnable taker state bundle

Verification

• cargo test --workspace
• cargo check --workspace --all-targets
• cargo test -p deadcat-rfq-client --test session_route
• cargo test -p deadcat-rfq-taker
• cargo test -p deadcat-rfq-wallet wallet_instance_id_derivation_is_stable_and_binds_every_input
• cargo fmt --all -- --check
• git diff --check

Strict Clippy was attempted through the Nix development shell, but Nix could not download base58ck because crates.io returned HTTP 403. Ordinary all-target compilation and the complete workspace suite pass.

Stacked on #43.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T05:16:16.765364Z	573f61a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.