Bind service time, enforce request timeouts, and match the shipped SDKs on the wire

[ristik]

Summary

• verify the reference-time-bound leaf value SHA-256(CBOR([txhash, tau]))
• carry the fixed reference time in inclusion proofs and certified transactions
• carry an exclusive request deadline, expires_at, in the transaction and certification wire formats
• keep the deadline optional: one wire shape per structure, with expires_at written as CBOR null when the caller did not supply one
• take Option<u64> instead of pairing every constructor with a *_with_timeout twin
• correct two wire divergences that made this crate unreadable by the shipped SDKs
• make InclusionProof total, mirroring js#151 and java#84
• release as 3.0.1

Cross-compatibility corrections

The cross-SDK fixture this crate tests against had been regenerated from an
unreleased intermediate state of the TypeScript SDK rather than from a tag. The
fixture and the code drifted together, so the whole suite passed while the crate
encoded two structures no other SDK could read.

Token was still at wire version 1. The TypeScript and Java SDKs moved it to 2
in 3.0.0 alongside MintTransaction, TransferTransaction and
CertificationData, and Token.fromCBOR rejects a version-1 token outright.

Certified transactions carried three elements, [transaction, referenceTime, inclusionProof]. Both other SDKs encode two and read the reference time off the
proof, which is the only copy consensus certified. The separate slot could only
agree with the proof or be wrong, and both decoders here held a guard checking
exactly that. The slot is gone and reference_time() reads the proof.

tests/vectors/transition_flow.json is regenerated from state-transition-sdk-js
v3.0.1, and tests/vectors/ now carries the generator and instructions for
pinning it to a tag.

Inclusion proof

InclusionProof requires every field; the absence of a certified leaf belongs to
the aggregator's answer. InclusionProofResponse owns the wire's two shapes:

pub enum InclusionProofResponse {
    Certified { block_number: u64, proof: InclusionProof },
    NotCertified { block_number: u64, unicity_certificate: UnicityCertificate },
}

That removes the four Option fields, the casts on the reference time, and the
absence branches at the top of both verification rules.
VerificationError::InclusionCertificateMissing and CertificationDataMissing
are gone because neither can occur.

Wire format

One version and one element count per structure. expires_at occupies a fixed
position and is uint | null, using the encode_nullable / Decoder::nullable
helpers that already encode data and justification in these same arrays.

MintTransaction      [2, networkId, recipient, salt, tokenType, justification, data, expiresAt]
TransferTransaction  [2, recipient, stateMask, data, expiresAt]
CertificationData    [2, lockScript, sourceStateHash, transactionHash, expiresAt, witness]
Token                [2, genesis, transfers]
CertifiedTransaction [transaction, inclusionProof]

An explicit deadline is committed by the transaction hash and enforced as an
exclusive bound. When it is absent the service assigns a deadline from consensus
reference time; that value stays service metadata, outside the leaf and outside
the signature, and no later verifier checks it. Omitting the deadline needs no
client clock.

API

Rust has no overloading and no default arguments, and Option is how it spells
optional. Taking Option<u64> as a trailing parameter deletes
create_with_timeout, new_with_timeout, mint_with_timeout,
transfer_with_timeout, split_with_timeout, split_unchecked_with_timeout,
and the mint_impl / transfer_impl bodies that existed only to hold the shared
code. It also removes the post-construction field mutation in
create_with_timeout, which assigned the field after create had already
derived the token id, lock script and mint state.

Validation

• cargo fmt --all --check, cargo clippy --all-targets --all-features -- -D warnings
• cargo test (113 + 10), cargo test --all-features (122 + 19 + 10), cargo test --no-default-features --features alloc (80 + 10)
• cargo build --no-default-features --features alloc --target wasm32-unknown-unknown

The http transport tests are gated behind a non-default feature, so cargo test
never compiled them and CI never ran them. CI now runs cargo test --all-features.

Cross-implementation agreement checked against shipped artifacts:

• the leaf value vector is byte-identical across this crate, state-transition-sdk-js 3.0.1, state-transition-sdk-java 3.0.1, aggregator-go and the rugregator, and matches an independent recomputation
• the CertificationData vectors for an explicit and an absent deadline are byte-identical across this crate, the TypeScript SDK and the Java SDK
• the certification-request envelope is byte-identical to the rugregator's golden request
• tokens minted and transferred by state-transition-sdk-js v3.0.1 decode, round-trip byte for byte, and verify here
• Java's CrossSdkEncodingTest and LeafValueTest pass against the same vectors

Refs #16
Refs #17