fix(settlement): wait for mined receipt, infer authorization status, and loosen recipient allowlist

[kapustazh]

Summary

Addresses live Arc Testnet settlement issues where broadcasts succeeded and funds moved on-chain, but the intent was prematurely marked UNKNOWN due to querying receipts before block inclusion. Also improves UI authorization status display and removes rigid recipient allowlist restrictions.

Changes

• Worker Receipt Retrieval: In PrivyArcWalletProvider, replaced single-shot getTransactionReceipt with waitForTransactionReceipt (with 15s timeout). Catches WaitForTransactionReceiptTimeoutError so the worker awaits the ~1-2s block confirmation before confirming settlement.
• Recipient Allowlist Wildcard: Updated Arc adapter config and Privy authorization adapter to support wildcard (*) and unrestricted recipient addresses. Updated worker readiness probe to fall back cleanly to walletAddress.
• Settlement UI Authorization Panel:
  • In contract.ts, inferred AUTHORIZED status for intents that progressed beyond authorization when the attempt record lacks explicit column values.
  • Suppressed submission failure reasons from rendering inside the Authorization panel when status is AUTHORIZED.
  • In PolicySummaryPanel, removed No allowlist reported badge and allowed recipients list.
• Cloud Build: Added cloudbuild-worker.yaml build manifest for worker deployments.

Validation

• PASS: pnpm test (64 files, 971 tests)
• PASS: pnpm typecheck
• PASS: pnpm lint
• PASS: pnpm format:check
• PASS: pnpm build
• PASS: pnpm build:frontend
• Verified live on Cloud Run (oneshot-worker-00011-xtk) and Cloudflare (https://oneshot.kapustazh.dev).