test: add WalletBeat safety matrix gate

[0xpantera]

Summary

• add docs/WALLETBEAT-SAFETY-MATRIX.md covering every pinned WalletBeat scam-alert and transaction-simulation fixture
• create/link follow-up issues for every missing positive safety feature (WalletBeat safety: address reputation and suspicious-recipient warnings #149–WalletBeat simulation: adversarial outcome warnings #153, plus existing revm preflight: simulate writes against verified state, feed both the agent gate and the human review card #73/Verified token metadata: read symbol()/decimals() through a verified eth_call, block un-curated tokens that can't verify #74/Rules engine v2: per-action policy + agent send over MCP + starter presets #135)
• add pnpm run qa:walletbeat:safety to fail if WalletBeat adds/renames a safety fixture without matrix coverage
• update WalletBeat QA docs and WalletBeat QA: add scam-alert and transaction-simulation coverage #95 execution plan

Intent

This PR deliberately does not claim Deckard has full scam-alert or transaction-simulation support. It closes the tracking gap: every WalletBeat fixture is now classified and every missing positive feature has an issue.

Follow-up issues created:

• WalletBeat safety: address reputation and suspicious-recipient warnings #149 — address reputation and suspicious-recipient warnings
• WalletBeat safety: contract age and previous-interaction context #150 — contract age and previous-interaction context
• WalletBeat safety: infinite approval and permit risk warnings #151 — infinite approval and permit risk warnings
• WalletBeat simulation: token and NFT asset-delta rendering #152 — token and NFT asset-delta rendering
• WalletBeat simulation: adversarial outcome warnings #153 — adversarial simulation outcome warnings

Test Plan

• pnpm run qa:walletbeat:safety
• cargo fmt --all --check
• just check
• cargo test --workspace
• pnpm run qa:extension
• pnpm run qa:extension:real
• pnpm run qa:walletbeat
• pnpm run qa:walletbeat:signatures
• pnpm run qa:walletbeat:transactions
• pnpm run qa:walletbeat:local-chain
• git diff --check

Closes #95