feat: deny-wins semantics + any-target + calldata guard for freedom gate

[gomesalexandre]

Prereq for the freedom co-signer policy gate in vultisig/verifier.

Three additions to the recipes engine, all backward-compatible:

what

DENY-wins semantics (engine/engine.go)

• Evaluate() now scans EFFECT_DENY rules before the ALLOW scan.
• If any DENY rule's constraints match the tx, evaluation returns a denied error immediately, regardless of any ALLOW rules.
• Existing ALLOW-only policies are unaffected (no DENY rules = no-op first pass).
• Implementation uses proto.Clone + effect override so DENY constraints run through the same chain-engine evaluation path as ALLOW — no duplicated logic.

Any-target support (engine/evm/evm.go)

• TARGET_TYPE_UNSPECIFIED now means "no recipient restriction".
• Used by the freedom policy native ETH transfer rule (any recipient, amount-capped).

Calldata guard in native transfer (engine/evm/evm.go)

• Rejects native-transfer rule evaluation if the tx has calldata.
• Without this, a contract call sending 0 wei silently passes the native-transfer amount cap.

tests

New TestDenyWins in engine/engine_test.go: builds a USDC approve(spender, uint256.max) tx and asserts a policy with DENY(amount=uint256.max) + ALLOW(MAX=uint256.max) returns a "denied" error.

risk

Low — all additive, existing ALLOW-only policies are unaffected.

🤖 Agent-generated

[gomesalexandre]

Heads-up: locally the engine tests hit a sonic/Go-1.26 linkname build error (invalid reference to encoding/json.unquoteBytes) across all packages — looks like a Go-version vs sonic-version detail, not the DENY change. Worth confirming the CI Go version builds clean (the consuming verifier#583 bumped sonic to v1.15.2 for Go 1.26; the recipes go.mod may want the same). The DENY-wins + calldata-guard logic is exercised end-to-end + green via verifier#583's gate tests.

[gomesalexandre]

Closing: this added DENY-wins / TARGET_TYPE_UNSPECIFIED / the assertArgsNative calldata guard specifically to feed the freedom MPC co-signer policy gate (verifier #583), which is now CLOSED — the live stack signs freedom txs on-device via the existing 2-of-2 (/vault/sign), not through a server-side co-signer. With no consumer, this rides along as dead weight. Reopenable if the recipes engine later wants DENY-wins as a standalone primitive.