feat: registry-based gas-token payment and fee reserves

[matthias-wright]

Replaces the hardcoded USDC gas handler with fee-asset selection driven by the GasTokenRegistry predeploy and the transaction's signed GasPayment selector, plus a set of accounting fixes the new reserve/settlement path depends on.

• Registry reads (gas_token_registry): bounded scan of the fixed storage layout (token, active flag, Shielded/Public mode, 0–18 decimals, balance slot) without warming or initializing slots; Auto picks native first, then the first active,
  mode-compatible entry in insertion order that covers the full maximum cost; Native/Token are strict with no fallback. Native value is never funded or split with tokens. Required read failures propagate as database errors; successfully read state
  that cannot pay is typed InvalidTransaction (GasTokenNotRegistered, GasTokenInactive, UnsupportedGasTokenMode/Decimals, GasTokenBalanceModeMismatch, GasTokenRegistryTooLarge, InvalidGasPaymentSelector).
• Settlement: per-token precision with ceil debits, floor refunds and the remainder to the beneficiary; Shielded entries use confidential balance writes, Public entries public writes, mode retained through reserve, deduction and refund; the token
  account is touched but not warmed and the registry is never touched.
• Journal/handler fixes: EIP-7702 authorizations roll back on transaction errors; failed-decryption gas accounting is normalized and consistent with and without an inspector; failed-decryption creation still consumes the nonce; nonce-max senders are
  rejected before any accounting.
• Tests: conservation and commit for every precision and mode, mode-mismatch rejection, retained journals and rollback, warmth/touch invariants, failed-decryption value handling, read-error discard semantics, and the settlement/error integration
  suites.