cow: retire the legacy cow-api host cone

[mfw78]

What

Deletes the legacy shepherd-cow-host extension, the shepherd:cow legacy WIT worlds (cow-api, cow-ext, shepherd; cow-events stays as the event-ABI package of record), the shepherd-sdk cow client cone, and shepherd-sdk-test mocks. Adds a sweep slice to composable-cow (poll-loop composition over the typed cow-venue client on videre:venue/client) and moves stop-loss onto #[videre_sdk::keeper] + pool submit, keyed on the venue-and-body intent-id. twap gates topic-0 on the sol decoder pinned against cow-events. Adds a WIT layering gate in cow-venue asserting no generic package references shepherd:cow. Marks ADR-0005/0006 superseded.

Why

Closes out the CoW-on-videre split for M4: the submit/status path is now served entirely by the cow-venue adapter over the pool, so the interim host-side cow-api shim is dead weight per the videre-split-plan §4 (the R2 category error resolution and the clean adapter/keeper re-split).

Testing

• cargo fmt --all --check
• cargo check --workspace --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo nextest run --workspace --all-features --no-fail-fast
• cargo test --doc

AI Assistance

Implemented with Claude Code assistance; reviewed and gated by mfw78.

Closes #293

[lgahdl]

This is the culmination of the whole venue-platform split tracked across this entire review session, so a few notes at that scale before the line-level findings:

• Process concern: bundling total cone deletion (4242 deletions) with the stop-loss migration and a new enforcement gate into one PR removes the ability to bisect a regression to one of those independently-risky changes. This session found real defects in nearly every predecessor PR in this train — a single atomic diff here is higher-risk for review surface, even if it's the right call for runtime cutover safety. Worth landing this shape as separate PRs next time (migration first, proven stable, then delete).
• Scope clarity: this closes the ADR-0010 (venue-as-adapter-component) half of the original design from #132 cleanly — but grep confirms zero references to EgressGuard/AllowAllGuard anywhere in this diff. ADR-0012's egress guard pipeline remains the advisory no-op flagged back in #433's review, entirely untouched. Worth being explicit that this PR closes the adapter-boundary half only; the egress-policy half is still open, not implied as done by "cone retirement."

On the code itself: deletion completeness checked out clean (workspace members, README, extensions.toml, engine configs, justfile all consistently updated, no dangling load-time reference found), stop-loss's migration avoids the signature-inclusive dedup bug from #468/#469 (it builds an unsigned order with no re-sign path, so that specific defect doesn't apply here), the journal check-then-act race is inherited unchanged from nexum-sdk::keeper::Journal (untouched by this diff, not newly introduced), and the new wit_layering.rs gate is actually correctly scoped this time — unlike the similar zero-leak scripts in #432/#449/#450/#462, it doesn't have a stale-pattern blind spot (though it's WIT-text-only, so a future Rust-level import of a CoW-specific type from a generic crate with no WIT reference would slip past it — worth pairing with a dependency-graph check eventually).

One real regression in test rigor worth a look:

[lgahdl]

The old test compared two independently-sourced values for equality (ConditionalOrderCreated::SIGNATURE_HASH from the sol! macro vs. events::CONDITIONAL_ORDER_CREATED.topic0 from the WIT-derived constant) — a real cross-check that would catch drift between the two sources. This rewrite computes expected from the same SIGNATURE_HASH source and only checks that hex string appears as a substring somewhere in the raw WIT file text — not a parsed/typed comparison against an independent second value. If the WIT-derived constant this used to check against drifted from SIGNATURE_HASH while the WIT file's text still happened to contain the old hex string anywhere (even in a stale comment), this test would still pass. This may be a necessary consequence of the events module being deleted along with the cow client cone rather than a deliberate weakening, but worth restoring an independent second source for the comparison if one is available (e.g. parsing the WIT file's actual const/comment value rather than a raw substring match).

[mfw78]

Pre-verified ahead of this car reaching the frontier, so it does not need re-deriving at review time.

This car deletes crates/shepherd-sdk/src/cow/events.rs (111 lines, whole file). That file was introduced by #463 and hand-rolled an EventAbi { signature, topic0 } struct whose topic-0 values were pasted b256! literals, duplicating what alloy_sol_types::SolEvent already derives from the signature at compile time.

Checked that the deletion re-points consumers at the generated constants rather than relocating the literals. On #463 the call sites read events::ORDER_PLACEMENT.topic0 and events::CONDITIONAL_ORDER_CREATED.topic0; at the end-of-train tip the same call sites in twap-monitor and ethflow-watcher read OrderPlacement::SIGNATURE_HASH and ConditionalOrderCreated::SIGNATURE_HASH. The only b256! literals remaining anywhere under shepherd/ at the tip are test fixtures (0101..., aaaa..., a load-gen salt), none of them topic-0 values.

So this is the correct end state and no follow-up is needed. Noting for completeness that between #463 and this car the tree carries hash literals whose sole guard is topic0_is_keccak_of_signature in that file's own test module, which does cover the drift, so the transitional window is acceptable rather than something to fix earlier.