feat(xtask): add forced withdrawal command and protocol docs

[adityapk00]

Adds tempo-xtask forced-withdraw to submit an encrypted, root-authorized full-balance withdrawal using only Tempo L1 RPC. Supports a separate fee payer, optional compensation approval, and waiting for settled inbox progress; waiting confirms consumption, not successful payout.

Updates the exit-hatch README and protocol spec with authorization and encryption, weighted admission, execution and rollback rules, ordinary settlement, and delivery/recovery. Documents that production activation and enforcing proof verification remain follow-ups.

Stacked on #1461 (codex/exit-hatch-execution-settlement). This PR contains only the CLI and documentation changes above that implementation.

Validation: git diff --check passed; spec ABI excerpts were checked against the contract interface. The squashed commit has an identical tree to the original branch tip. Tests were not rerun for this history-only squash.

[adityapk00]

cyclops audit fast

[github-actions]

cc @adityapk00

Cyclops audit event published. View workflow run

Config: config: default, iterations: 1, hours: default

[tempoxyz-bot]

👁️ Cyclops Review

This PR adds an xtask forced-withdraw command and documentation for TIP-1012 forced withdrawals. One actionable issue was found: the CLI trusts a user-supplied portal address for both validation and the compensation approval amount, which can expose the fee payer's selected TIP-20 balance when --approve is used.

Reviewer Callouts

• ⚡ Forced-exit crypto canonicalization: Existing forced-exit crypto paths allow two low-impact alternate encodings: ECIES HKDF does not bind the ephemeral public-key parity byte, and secp256k1 recovery-byte normalization accepts multiple encodings for the same signature. Nonce/domain binding prevents replay or fund loss today, but maintainers may want to canonicalize while the spec is being updated.
• ⚡ Witness confidentiality assumption: Forced-exit processing relies on advanceTempo decryption witnesses being kept as sensitive as plaintext authorizations. This is a base-design assumption rather than a PR regression, but it is worth confirming that operational visibility of zone block bodies/witnesses matches that threat model.