feat: add safe reference-script pre-submit capture

[colll78]

Summary

• add a diagnostic pre-submit capture path that signs once and records exact signed CBOR without submitting
• validate transaction and script hashes, Flat encoding, deployment session identity, batch coverage, and input lineage
• persist private capture artifacts atomically with fsync-backed completion

Safety model

The capture path is structurally non-submitting. It aborts before any provider submission and produces durable evidence suitable for deployment diagnostics.

Verification

• frozen offline install with pnpm 9.15.4
• Aiken testnet build
• Node 22 typecheck and production build
• 14 focused capture-safety tests
• 47 existing reference-script and deployment regression tests
• two real PostgreSQL-backed emulator paths
• independent final review