feat(guardian): one rotation verdict and one status derivation behind a claim fence

[WiktorStarczewski]

Every user-facing claim about a guardian rotation or the guardian's live status now comes from one of two derivation modules, with a source-scan fence so no surface can reintroduce a local reading of the raw fields — closing the defect class behind six separate findings in #786's review (a surface certifying a rotation the wallet never confirmed).

• lib/miden/guardian/rotation-verdict.ts — the only reader of commitUnconfirmed / registerFailed / endpointPersistFailed; rows map to a closed verdict union where "unconfirmed" is a variant, never a flag default.
• lib/miden/front/guardian-presentation.ts + useGuardianPresentation — the only derivation of pill / fault / last-sync / prompt; sendsBlocked is the assertGuardianInSync predicate imported, not restated.
• Migrated: settings pill, receipt, generating screen, drift-banner gates (Home + banner), Activity row title (derived at render, not the displayMessage snapshot), dApp sync-status coarsening.
• Fixes three surfaces that still lied on an unconfirmed rotation: Activity chip and details status pill now read amber "Submitted" instead of green "Confirmed"; row title says "Guardian switch submitted".
• guardian-claim-fence.test.ts — source-scan over src/ with an explicit allowlist (interpreters, the one writer, transport plumbing); adding a raw read elsewhere fails CI.
• 3 new i18n keys, translated in all 14 locales (guardianSwitchUnconfirmedHeading's existing translations reused for the row title).

Also closed in passing

• The receipt's isSwitchGuardianExtraInputs guard silenced all three flags on a row with a malformed newGuardianEndpoint; the verdict reads flags regardless, so such a row now shows its honest warning.
• The presentation module defines away "fresh but no stamp" instead of trusting the caller's pair of inputs.
• Invariant tests over the full input product: unconfirmed never renders confirmed (27 flag combinations), online never renders while sends are blocked (128 rows), plus the fence's self-test.

Part 1 of 4 of the seam plan from #786's review (next: guardian-write CAS, attempt ledger, recovery dispatcher). No writes touched — pure derivation + surface migration; 604 suites / 9,991 tests, ts, lint, i18n all green.

Reviewers: the fence allowlist in guardian-claim-fence.test.ts is the part worth your time — it is the claim that this list of raw-field readers is complete and correct.