customanchor: surface structured verification failures

[darioAnongba]

Structured custom-anchor verification failures

Closes #159. Follow-up to #158 addressing sub-issue #144.

The custom-anchor builder's verification result already reports the success path as structured Checks carrying Scope, Origin (SDK-local / backend-trusted / host), and a stable Code. Its failure path did not: every failure in Build returned an opaque fmt.Errorf string plus a nil plan, and the CustomAnchorVerificationIssue type — with Severity, Scope, Origin, Code, and input/output locators — was never constructed in production. Callers could not branch on failure class, so #144's core promise ("return structured failure information callers can use to decide whether signing is safe") was unmet on the failure path.

What this changes

• Adds CustomAnchorVerificationError, a typed error that carries a CustomAnchorVerificationIssue and unwraps to its cause. Any verification failure is now machine-branchable via errors.As even when Build returns a nil plan:

plan, err := builder.Build(ctx, req)
var verr *tapsdk.CustomAnchorVerificationError
if errors.As(err, &verr) {
    switch verr.Issue.Scope {
    case tapsdk.CustomAnchorVerificationScopeAmount:      // ...
    case tapsdk.CustomAnchorVerificationScopeInputProof:  // ...
    }
}

• Adds result helpers OK(), Errors(), Warnings(), and an addCustomAnchorIssue helper (the failure/warning counterpart to addCustomAnchorCheck) for the paths that can carry warnings.
• Wires the plan-verification failure sites to structured errors with the correct scope, origin, and input index: request, input-proof (SDK-local decode and backend-trusted VerifyProof), asset-identity, amount conservation, anchor output, commitment, and duplicate-input.

Tests

custom_anchor_verification_test.go covers the result helpers, errors.As/Unwrap behaviour, and a table-driven pass asserting each failure class returns a *CustomAnchorVerificationError with the expected Scope/Code/Origin/Severity and input locator. go build, go vet ./..., and go test ./... pass; gofmt clean.

Not in this PR (tracked in #159)

The passive-asset and loss-policy sites, the compact-proof-path input branch, and the capability gate (which already returns its own structured UnsupportedCustomAnchorCapabilityError). Returning a partial plan carrying Warning-severity issues (rather than only failing hard) is also left for a follow-up once the remaining sites are converted.

[darioAnongba]

Closing: not needed for SwapDK to be correct and complete. Build/Commit already return an error and a nil plan on any verification failure, so a caller cannot sign or publish an unverified transfer — this only added a machine-branchable classification of the failure, which is diagnostics polish (and it duplicated the existing CustomAnchorVerificationResult.Valid()). Deferring the broader #144 failure surface as SDK hardening rather than SwapDK-required scope.