multi: reserve asset carrier inputs

[darioAnongba]

Summary

• require asset sends to name a wallet-managed asset VTXO instead of bypassing the wallet with a custom input
• reserve required asset VTXOs first, then add only ordinary Bitcoin VTXOs when more carrier sats are needed
• preserve deterministic selection and minimum-change behavior while excluding unrelated asset-bearing VTXOs
• write durable preparation ownership before tapd is allowed to commit
• release safe pre-commit failures atomically and quarantine unknown or post-checkpoint outcomes for reconciliation
• share one reservation store across the VTXO manager, OOR actor, and tap-sdk runtime

This is stack 3 of the Wavelength Taproot Assets PoC and depends on #1034. It deliberately leaves mixed checkpoint packages and partial asset change to the next transaction-builder stack.

Validation

• make unit
• focused db, oor, tapassets, vtxo, wallet, waverpc, waved, and cmd/waved tests
• focused race suite
• make build
• make lint-changed-local
• make commitmsg-lint range=origin/main..HEAD

After rebasing on current main, the focused package suite was rerun and passed.

Docker was unavailable during generation, so SQL and protobuf output was produced with the exact repository-pinned sqlc 1.29.0 and protoc 3.21.12 toolchains.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dda6a5232b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep committed asset inputs locked when OOR admission fails

When assetPreparer.PrepareTaprootAssetOOR succeeds, it may already have committed the checkpoint and Ark Taproot Asset transitions, but releaseSelected remains true until a successful non-existing OOR response. Thus an OOR actor error here (or the invalid-response path below) falls through to the deferred unlock, returning the asset-bearing VTXO to Live and deleting its preparation reservation even though the asset transition has crossed its external commit boundary. A subsequent spend or restart sweep can then reuse an input whose asset state is no longer safe to retry; asset sends should quarantine the input after successful preparation unless actor admission is durably accepted.

Useful? React with 👍 / 👎.