feat(sdk): submit appData hash-only and retire resolve_app_data

[mfw78]

Summary

• Submit CoW orders with appData as the 32-byte on-chain hash and retire the resolve_app_data round-trip, so the module no longer fetches the full appData document before submission.
• Bump cowprotocol 0.1 -> 0.2 to pick up the hash-only OrderCreationAppData constructor, patched via [patch.crates-io] to the nullislabs/cow-rs fork rev 17fc0c5 until a release with the constructor ships.

Changes

• Delete crates/shepherd-sdk/src/cow/app_data.rs (269 lines) and its mod.rs/lib.rs/README references.
• Rework modules/twap-monitor/src/strategy.rs to submit order.appData verbatim (the hex digest, appDataHash absent) with no preceding appData GET.
• Remove the now-redundant GET /api/v1/app_data/{hash} route from tools/orderbook-mock and the matching 404 branch in twap-monitor.
• Migrate stop-loss and a shepherd-cow-host test off the deprecated from_signed_order_data; drop the serde_json dependency from the SDK.

Test plan

• cargo fmt --all -- --check
• cargo clippy (scoped: shepherd-sdk, shepherd-cow-host, orderbook-mock, load-gen) -D warnings, clean
• cargo test scoped to touched crates (twap-monitor 21/21 native; SDK/host/mock suites green)
• wasm32-wasip2 release builds + clippy for twap-monitor, stop-loss, ethflow-watcher
• wasm-tools component wit on twap_monitor.wasm: only nexum/shepherd/wasi imports (no wasm-bindgen)
• Whole-epic just ci battery green via the sdk: extract the venue-generic strategy chassis #135 red-team sweep (PR fix(keeper): drop stale watches and idle duplicate rejections #242)

Notes for reviewer

• This is the base of the M1 chassis train; PR feat(sdk): add keeper stores over the local-store host trait #237 stacks on it. It targets fix/fault-train-hardening (the in-flight fault-train tip); merges bottom-up after that train lands, retarget to develop then.
• The cowprotocol 0.2 bump introduces a client-side one-year valid_to max-horizon check. Beyond-horizon Eip1271 tranches are dropped through the retry ledger (watch-tower parity) rather than looped on; this was hardened and tested in the sdk: extract the venue-generic strategy chassis #135 sweep (PR fix(keeper): drop stale watches and idle duplicate rejections #242).
• [patch.crates-io] points at the nullislabs/cow-rs fork; drop the patch once a cowprotocol release carries the hash-only constructor.

Closes #133

[lgahdl]

Reviewed the full diff. Solid simplification — hash-only submission with watch-tower parity is clearly the right shape, and −546 lines including the whole resolve_app_data module plus its mock route is a real maintenance win. The test rewrite is careful (the appDataHash-absence assertion being load-bearing is a nice catch). Three non-blocking observations:

1. stop-loss asymmetry: twap-monitor moves to OrderCreation::new_app_data_hash_only, but stop-loss stays on the document-shape OrderCreation::new. If that's deliberate (stop-loss authors its own doc so the digest always matches), a one-line comment at the stop-loss call site would stop the next reader from "fixing" it into hash-only; if it's not deliberate, hash-only would let stop-loss drop its remaining serde_json usage too.

2. Replacement coverage for the deleted 404 test: poll_ready_skips_submit_when_app_data_hash_not_mirrored covered the unmirrored-digest path; its post-change equivalent (orderbook rejects INVALID_APP_DATA → classify_api_error dispatches backoff rather than tight-looping) doesn't have a strategy-level test in this diff. If that lives upstack in #242/#259's sweep, a pointer in the PR body would close the loop; if not, it's worth one test since this is the exact path the old code handled specially.

3. Horizon check vs manual clocks: the 0.2.0 constructor's one-year valid_to horizon reads the wall clock, which in guest builds is the WASI clock — under the harness ManualClock override, guest time can sit arbitrarily far from realistic validTo values, so harness-driven submit paths could spuriously classify orders as beyond-horizon (or never). Tests here handle it via valid_to_in(), which is right; flagging the interaction mostly as a cross-ref to #169/#172 where the horizon-check consequences are being tracked, in case the manual-clock angle isn't on the radar there.

(The [patch.crates-io] documentation in Cargo.toml is exactly what our docs sweep in #311 points at — nice that the comment names the drop condition.)