feat(cacp): add protocol-enforced costly abort demo

[Warrenhimself]

🎯 Purpose

Add a CACP reference implementation and a protocol-enforced costly-abort mechanism for LEZ. The goal is to demonstrate atomic two-zone inscription submission together with executable public-account stake forfeiture, without relying on inscription execution or a trusted resolver.

⚙️ Approach

• Add the two-party CACP state machine for an atomic two-zone Bedrock transaction.
• Add a neutral cacp_bond LEZ program with proposal-specific state and escrow PDAs.
• Lock stake from two funded LEZ public accounts through authenticated transfers.
• Verify Ed25519 commitments and disclosures inside the bond execution zone.
• Settle challenge timeouts and stake forfeiture without a resolver or custodian key.
• Add a live local multi-process demo and a just demo-cacp entry point.

The demo starts one local Bedrock Docker node, participant Zone A and Zone B with one sequencer each, and a third neutral bond execution zone with its own sequencer.

The joint Bedrock transaction contains exactly two business operations, both ChannelInscribe. The Bedrock wallet may append one final Transfer operation for the transaction fee. The bond program executes separately because inscriptions do not provide execution semantics.

Each participant locks 1,000 units from a distinct LEZ public account. A challenge adds a 100-unit bond. Program-controlled chained transfers move the balances into or out of a proposal-specific escrow PDA.

🧪 How to Test

cargo fmt --all
cargo test -p cross_zone --lib
cargo test -p cacp_bond_core
just demo-cacp

Expected results:

• cross_zone: 9 tests passed.
• cacp_bond_core: 1 test passed.
• The live demo ends with ALL 5 LIVE CACP SCENARIOS PASSED.

The demo covers:

1. Happy path: Sequencer A submits and both channel tips advance atomically.
2. Phase-3 fallback: Sequencer A stalls and Sequencer B submits the identical fully signed transaction.
3. Pre-Phase-3 safe abort: no submittable transaction exists and neither channel advances.
4. Stale parent: Bedrock atomically rejects both inscriptions.
5. Costly abort: the neutral bond program settles both B withholding ACCEPT and A withholding FINALIZE, transferring the forfeited stake to the honest public account.

🔗 Dependencies

No dependent PRs.

🔜 Future Work

This PR intentionally excludes bridges, application tokens, ping programs, an indexer, a web UI, and additional ZK protocol work.

The demo runs on a real local LEZ development network, not a public testnet or mainnet. The demo command uses RISC0_DEV_MODE=1 for practical local execution.

📋 PR Completion Checklist

• Complete PR description
• Implement the core functionality
• Add/update tests
• Add/update documentation and inline comments