Swap v1 GUI (#25) + CommitFlow surface refactor + QA fast-unlock

[hellno]

Summary

Ships the Swap v1 GUI (#25) — CoW Protocol market swaps (compose → live quote → clear-signing order review → hold-to-confirm → sign over the private control channel → submit) — on top of an app-layer refactor that collapses the duplicated Send/Shield surfaces onto a shared CommitFlow + commit_view (one tested hold-to-confirm / epoch / clear-signing path; adding a surface is now a descriptor, not a copy). Also lands the swap core plumbing (chain-keyed fetch_portfolio, EthProvider::allowance, a key-less CowOrderbook whose blocking wrappers own tokio so the GPUI app never touches it), a DevEx fast-unlock (just qa-vault/just qa — a throwaway pre-sealed vault that skips onboarding), and docs (keyless sepolia.drpc.org local-testing recipe). Net diff: 22 files, +3951/−1305; no dependency changes.

Linked issue

Closes #25

Definition of Done

• cargo fmt --all --check is clean
• just check is green — clippy -D warnings on both the default config and --features tray
• cargo test --workspace is green
• No new or changed dependencies in Cargo.toml / Cargo.lock (the diff touches neither file)
• Visual/UI follows DESIGN.md (swap reuses the shared clear-signing card + amber hold-to-confirm; cool token swatches off the cyan/agent + amber/human axes; centered like Send/Shield)
• Secrets stay in Zeroizing and are never logged/Debug-printed (this PR adds no seed/key handling; the swap path signs via the existing key-less signer wire)

Evidence (paste command output here)

$ cargo fmt --all --check
(clean)

$ just check
cargo clippy --locked --workspace --all-targets -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.09s
cargo clippy --locked -p deckard-app --all-targets --features tray -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.74s

$ cargo test --workspace        # (TMPDIR=/tmp to avoid the macOS SUN_LEN socket-path limit)
test result: ok. 42 passed; 0 failed; ...   (deckard-app, incl. 12 swap + commit_flow/errors tests)
test result: ok. 55 passed; 0 failed; 1 ignored; ...   (deckard-core; 1 ignored = live-network CoW quote)
test result: ok. ... (deckard-signerd: resolver_auth, swap_lifecycle, shaped_approve, daemon_e2e, guardrail, ...)
# 18 test binaries, 0 failed across the workspace

Notes for reviewers

• App-layer refactor first, Swap second. commit_flow.rs (epoch/hold/reset state machine + unit tests) and commit_view.rs (generic render_commit + shared hold-to-confirm + per-surface descriptor) are the foundation; Send and Shield were migrated onto it byte-for-byte (verified live) before Swap was built native. Reviewing in that order helps.
• Runtime fix worth a look: CoW HTTP (reqwest/hickory) needs a tokio reactor that GPUI's executor lacks, so it's routed through deckard-core::CowOrderbook::{quote,put_app_data,submit}_blocking (current-thread runtime + block_on, mirroring eth.rs/shielded.rs) — the app deliberately never touches tokio. The swap orchestrator (confirm_swap_blocking) is therefore fully synchronous and runs inside cx.background_spawn.
• Trust invariants (carried from Swap v1 trust path: CoW module, contract order types, signerd EIP-712 signing + shaped approve + cancellation #24): the shaped approve is the bound order's gross sell amount, value==0, spender = GPv2 vault relayer, proposed after the order; resolve+sign ride the private AF_UNIX control channel; receiver is always the wallet.
• Live-validated on a Sepolia fork through the order-review card (real CoW quote: 1 USDC → 0.608 COW). Known limitation: a true order-accepted+open on the live CoW orderbook is not reachable from a local fork — the orderbook validates balance/allowance against real Sepolia, not the fork — so that final step needs the Swap v1 agent + demo: MCP swap tools, fork-demo stub, swap-e2e harness #26 fork-demo orderbook stub (or a wallet with real Sepolia funds). Deliberately out of scope here.
• Deferred (TODO in code): open-order status polling + in-app cancel; sell-token balance in the compose screen.
• Test caveat: signerd socket tests need TMPDIR=/tmp on macs with a long $TMPDIR (the AF_UNIX SUN_LEN 104-char limit); the one ignored test is the live-network CoW quote.
• A final codex adversarial pass couldn't run (session limit, then a transient server rate-limit); the in-workflow codex review returned compile-plausible with 0 must-fixes.