fix(canton): require confirmed funds before settle success

[PhilBot402]

Description

Canton settle was returning success: true when /execute had committed but the funds-moved read was inconclusive. Success now requires a read that proves funds moved, the same bar as other networks.

A timeout, transport error, 5xx, or unreadable confirmation returns non-terminal settlement_pending with a non-empty transaction (the updateId, or the submission id when the update id is not known yet). @x402/core retries settle once with the same payload. That retry re-reads the same submission and does not relay again. It returns success only if funds moved. A still-unreadable read is terminal unexpected_canton_ledger_error. A read that shows the transfer did not deliver is invalid_exact_canton_execute_failed.

There is no further retry and no replay cache. The in-memory entry exists only so that one retry can re-read; it is dropped on the retry, and a later settle relays again. The ledger still rejects a replay once the input holdings are spent.

Sits on upstream PR 3242 head 48f6414c (Denend:feat/mechanisms-canton).

Tests

• pnpm exec tsc --noEmit in typescript/packages/mechanisms/canton
• pnpm exec vitest run (103 tests) and pnpm exec vitest run --config vitest.integration.config.ts (5 tests)
• New test/unit/settle.test.ts: success only on a proven transfer; pending then one confirm; terminal failure if the re-read is still unreadable; a later settle relays again; unknown execute with a submission id is pending, without an id is terminal

Checklist

• I have formatted and linted my code
• All new and existing tests pass
• My commits are signed (required for merge) -- you may need to rebase if you initially pushed unsigned commits
• I added a changelog fragment for user-facing changes (docs-only changes can skip)

AI disclosure: automated by @phdargen. Use your own judgement.