security: replace legacy Basis contracts with reviewed v2 generation

[a-shannon]

Summary

This replaces the production Basis v1 / layer2-old contract surface with an
exact, versioned Basis v2 generation for ERG and token reserves. Historical v1
sources remain available only as digest-bound test fixtures; they are no longer
compiled, exposed by production helpers, printed as deployment targets, or
packaged in the main JAR.

This is the on-chain/Scala half of the remediation. The paired tracker changes
are published in BetterMoneyLabs/basis-tracker#12.

Security rationale

The previous production surface mixed legacy contracts, builders, addresses,
and deployment helpers with the active application. The v1 claim identity and
global reserve-state model also could not safely distinguish independent
reserve generations. Keeping those paths callable while adding a new contract
generation would make accidental legacy construction and cross-reserve state
reuse possible.

The v2 design binds every claim to its exact domain: reserve NFT, optional
reserve token id, tracker NFT, owner, and receiver. Tracker and per-reserve AVL
state use separate fixed shapes, and the redemption ABI is frozen across the
contract source, compiled ErgoTree/P2S bytes, Scala tests, and the Rust tracker.

Changes

• add exact ERG and token Basis v2 contracts and reviewed P2S goldens;
• freeze source, compiler/dependency, tree, P2S, and cross-runtime claim-key
  receipts;
• test exact R4-R9 registers, token ordering, tracker/reserve AVL metadata,
  signatures, ordinary redemption, and the emergency branch;
• add isolated negatives for wrong owners, tracker identity, malformed AVL
  metadata, asset/domain mismatches, and ERG/token variants;
• remove legacy production getters, builders, printers, contract resources,
  demo paths, and participant-secret helpers;
• retain the historical v1 contract sources only under test resources with
  canonical-LF digests that are stable across Windows and Linux checkouts;
• inspect the packaged main JAR to prevent retired classes or resources from
  returning.

Validation

• BasisV2Spec: 22/22
• seven non-secret suites: 130/130
• historical retirement and digest fixtures: green on both CRLF and exact-LF
  checkouts
• main JAR: 77 entries, no retired v1/legacy class, API, or contract resource
• main JAR SHA-256:
  36f5ecdad28f5a8bb56b2e5a75348e724af76fb524c27b33e099b7a00a0bd845
• exact source/P2S/receipt blobs match the independently reviewed v2 candidate
• diff and publication guards pass for the complete branch history

Boundaries

• This is a draft for maintainer review, not a deployment or production-readiness
  claim.
• No live node, funded transaction, signing, broadcast, deployment, or remote CI
  run was performed.
• ParticipantSecretsSpec was not run because its local secret fixture is not
  available; all seven non-secret suites are covered.
• Runtime activation, chain reconciliation, local signing, and legacy-route
  retirement are handled by the paired tracker PR.