feat: add Solana token risk check plugin

[fengyangxxx]

Summary

• add one T0 read-only token-risk-check WASM component for canonical Solana mints
• report mint/freeze authority, wallet-owner concentration, indexed liquidity, and Token-2022 transfer-fee, transfer-hook, and permanent-delegate evidence
• keep risk logic in a host-testable pure Rust core with a thin wasm32-wasip2 WIT v0 shim
• fail closed to incomplete Amber on missing, malformed, inconsistent, redirected, oversized, or timed-out evidence

Safety and configuration

The tool schema accepts only mint; callers cannot choose RPC methods or endpoints. The jailed host config requires rpc_url and may optionally provide liquidity_url. Without the optional key, the plugin reads the fixed DexScreener token endpoint directly. The optional endpoint is for operators whose WASI HTTP egress cannot reach the public provider: it must be public HTTPS, receives only the canonical mint path suffix, and must return the unmodified DexScreener response. The component still performs all parsing and risk classification locally.

The manifest grants only http_client and config_read. There is no private-key, signing, transaction, trading, filesystem, process, socket, or WebSocket path. Indexed liquidity is not represented as LP lock, burn, ownership, sellability, or price-impact evidence.

Validation

• cargo test --locked: 158 passed, 0 failed, 0 ignored
• host and wasm32-wasip2 release clippy with -D warnings: passed
• cargo build --locked --target wasm32-wasip2 --release: passed
• tools/ci/validate_components.sh token-risk-check: passed with natural exit 0
• stock ZeroClaw runtime: real BONK assessment completed in 7.389 seconds, resolving 20 wallet owners and 30 positive indexed-liquidity pairs with bounded output and no endpoint/body leakage

Scope

This PR adds only plugins/token-risk-check/. The README documents configuration, custody tier, threat model, worked output, prompt-injection regression transcript, build/run steps, WASI friction, evidence limitations, and next steps.