fix: make deposit submission crash-safe

[colll78]

Summary

• persist exact signed deposit CBOR and immutable semantic identity before any provider call
• enforce a one-way Prepared -> SubmissionUnknown claim so only a never-claimed row can make one initial exact-byte submission
• reconcile canonical Kupo and Ogmios evidence without rebuilding, re-signing, or automatically resubmitting post-call states
• add bounded observation-only startup reconciliation and operator reconcile/resume commands
• fold the lifecycle schema into the fresh baseline

Safety model

Accepted or committed evidence blocks submission. SubmissionUnknown, Submitted, and Ambiguous are observation-only and never reopen. Provider disagreement, stale indexer coverage, missing dependencies, response loss, and pruned historical evidence fail closed.

Verification

• frozen offline install with pnpm 9.15.4
• Node 22 typecheck, Prettier, production build, and compiled CLI help
• 44 provider and submission-utility tests
• 6 real PostgreSQL lifecycle and schema tests
• 5 real PostgreSQL crash-boundary tests
• real-contract fresh-schema deposit and emulator regressions
• independent final differential review