Extend nonce_manager to handle ML-DSA-65 PQ-signed tx envelopes

[abhicris]

Problem

nonce_manager.py (PR #11) tracks nonces per (chain_id, address) for ECDSA-signed txs with reorg protection. Once the PQ envelope (issues #33, #34, #36) lands, the same agent address may sign txs under either ECDSA (today) or ML-DSA-65 (PQ envelope), and a malicious chain can serve a reorg in which the agent's pending PQ-signed tx is dropped and an ECDSA-signed replacement is re-mined at the same nonce.

The nonce manager needs to handle the dual-sig-scheme case so an agent never accidentally signs two different txs at the same nonce under different signature algorithms.

Proposed Approach

1. Extend nonce records with signature_alg tag matching the PQ envelope's signature_alg field (per [PQ-1] Spec §11: PQ signatures — transcript, algorithm registry, wire format #34 spec):
   • 0x01 = ECDSA-secp256k1 (today's default)
   • 0x02 = ML-DSA-65 (post-PQ envelope landing)
   • 0x03 = hybrid (ECDSA + ML-DSA-65, both must verify)
2. Per-nonce mapping holds the signature_alg of the tx originally signed at that nonce. Reorg recovery refuses to re-sign at the same nonce with a different scheme tag without explicit operator override (--force-rebroadcast-alg).
3. New API: NonceManager.next_nonce(chain_id, address, alg) — atomic check-and-increment that asserts the scheme tag matches any pending tx at that nonce.
4. Storage migration: existing records auto-tagged 0x01 (ECDSA) on first read post-upgrade.

Acceptance Criteria

• signature_alg field present in every nonce record
• next_nonce() API rejects scheme-tag mismatch
• Reorg test: PQ-signed tx dropped, ECDSA replacement at same nonce blocked without override
• Hybrid mode reserved but not implemented (placeholder behind feature flag)
• Test corpus covers all 3 scheme tags + the 6 cross-product combinations

References

• PR fix: Implement nonce manager with reorg protection #11 — nonce manager with reorg protection
• Issue [PQ-0] Meta: post-quantum signed agent-to-agent payments #33 — PQ-0 meta
• Issue [PQ-1] Spec §11: PQ signatures — transcript, algorithm registry, wire format #34 — PQ-1 spec section 11 (algorithm registry)
• Issue [PQ-3] switchboard/pq_keys.py — keypair generate/load/save + key-id derivation #36 — PQ-3 key storage (provides the signing key for ML-DSA-65)
• internal: see PQ envelope draft at switchboard/docs/post-quantum.md