shinigami: encode versioned Cairo claims for pubkey VTXO exits

[patrickdugan]

Summary

• add an unpublished bark-shinigami workspace crate for the versioned 25-field ArkTaprootMiniscriptClaim Cairo ABI
• derive the owner emergency-exit TapLeaf, Merkle root/path, amount, delay, manifest id, and path commitment from a caller-validated pubkey-policy Bark VTXO
• pin the exact LF-normalized Cairo source and its SHA-256, with canonical external vectors and a Bark-derived golden vector
• wire the crate into MSRV, arithmetic-Clippy, and wasm32 CI coverage

Security boundary

This is an experimental input interoperability layer. It does not execute Bitcoin Script or Shinigami, generate or verify a STARK proof, validate the caller-provided settlement commitment, or authorize spending. The Cairo mixer is linear and non-cryptographic. Cooperative key-path spends and HTLC VTXOs are intentionally unsupported.

Test coverage

• cargo test -p bark-shinigami: 13 unit tests plus the Cairo source-pin integration test
• Clippy, release, no-default-features, all-targets/all-features, and rustdoc with warnings denied
• Rust 1.74 MSRV check
• wasm32-unknown-unknown build with wasm-web
• Scarb 2.18.0 fixture test and execution of all six checked-in inputs through the pinned Cairo source
• independent verification of five stored STWO proofs
• rejection of a deliberately tampered proof/program statement
• Bark tab/indent, whitespace, server-log, migration-version, and diff checks

The full Nix-wrapped workspace checks were not available in the Windows environment; the targeted equivalents above passed and CI should run the repository-wide gates.