feat: add RentDestination permission for close rent recipients

[tracy-codes]

Summary

• add a zero-length RentDestination permission/action and wire it through state, interface, and Rust SDK mappings.
• enforce close rent-recipient checks for CloseSwigV1 and CloseTokenAccountV1: when any role has RentDestination, destination must match a RentDestination authority; when none exist, keep legacy behavior and allow any destination.
• keep close authority checks independent from rent-recipient checks so the closer and rent recipient can be different roles.
• add integration coverage for restricted and unrestricted destination behavior, including separate closer vs recipient roles.
• document the new permission and close behavior in docs/program_diagrams.md.
• pin lockfile dependency resolution (blake3 to 1.8.2) to keep cargo build-sbf --arch v1 working with the current toolchain.

Validation

• cargo fmt --all
• cargo build-sbf --arch v1
• cargo nextest run --config-file nextest.toml --profile ci -p swig --test close_swig_authority_test
• cargo nextest run --config-file nextest.toml --profile ci --all --workspace --no-fail-fast (run earlier on this branch before final test-only additions)