feat(frost/roast): close M4 -- reject + conflict evidence categories

[mswilkison]

Summary

Closes the M4 gap from the original PR #3866 review by adding
the two evidence categories the RFC-21 Phase-2 work left as future
work: validation-rejection evidence and first-write-wins-conflict
evidence.

With this PR, the `NextAttempt` policy can permanently exclude
misbehaving peers on all four ROAST blame channels --
transport-overflow, validation-reject, equivocation-conflict, and
silence -- instead of just overflow + silence.

Why this matters

A peer that only sends malformed messages (validation rejects,
never overflows the channel) was previously indistinguishable from
a silent peer. The transient silence-parking policy would
bench-and-reinstate them indefinitely, never permanently excluding
the malicious behaviour. Same for a peer equivocating mid-attempt:
the existing first-write-wins assembly correctly dropped the
conflicting retransmission but only logged the event -- the bundle
carried no structured evidence the coordinator's policy could act
on.

What lands

Recorder API

Surface	Notes
`RecordReject(sender, reason)`	reason captured verbatim; per-reason quota counter
`RecordConflict(sender)`	saturates at conflict quota
`RejectQuotaDefault = 8`, `ConflictQuotaDefault = 4`	matches RFC-21 Layer A categoryQuota
Per-reason quotas independent	peer cannot saturate one reason to mask another

Wire types

Type	Sort order	Cap
`RejectEntry{Sender, Reason, Count}`	asc by Sender, then asc by Reason	per-attempt evidence size bounded by Σ quotas
`ConflictEntry{Sender, Count}`	asc by Sender	per-attempt evidence size bounded by Σ quotas

Both fields use `omitempty` so pre-PR snapshots round-trip without
the new fields. `Validate()` enforces sorted-ascending invariants.

NextAttempt policy

Threshold	Value	Source
`RejectExclusionThreshold`	1	RFC-21 Layer B ("any non-transport reject is sufficient cause")
`ConflictExclusionThreshold`	1	A single conflict is byzantine evidence

`computeNextAttempt` merges `overflowBlamed`, `rejectBlamed`,
`conflictBlamed` into the permanent ExcludedSet. The
`blamedSenders` helper is factored out so all three categories
share the deterministic sort + threshold-comparison logic.

Receive-loop wiring

Three reject sites and three conflict sites updated across the two
files that house the three FROST/tbtc-signer receive loops:

Site	Was	Now
`shouldAcceptNativeFROSTMessage` returns false	silent drop	`evidence.RecordReject(senderID, "validation_gate_rejected")` + drop
First-write-wins conflict in assembly loop	warn log only	`evidence.RecordConflict(senderID)` + warn log

Test coverage (15 new cases)

• 7 recorder tests: accumulation, per-reason quota saturation, per-reason independence, conflict saturation, all-categories-present, NoOp-inert, RFC-constant assertions
• 5 policy tests: single reject excludes, single conflict excludes, reject+conflict on different senders, empty evidence (sanity), threshold-constant assertions
• Receive-loop wiring is covered indirectly by the recorder unit tests; the NoOp default keeps pre-RFC-21 receive semantics observably unchanged so no integration-level test is required.

Verification

Command	Result
`go build ./...` + `go build -tags 'frost_native frost_tbtc_signer frost_roast_retry' ./...`	both clean
`go test ./pkg/frost/...` + race	pass
`go test -tags 'frost_native frost_tbtc_signer frost_roast_retry' ./pkg/frost/...`	pass (5 packages)
`staticcheck -checks '-SA1019' ./pkg/frost/...`	silent
`go vet ./pkg/frost/...` + `gofmt -l ./pkg/frost/`	clean

RFC-21 status

With this PR, all four ROAST evidence categories are operational.
M4 from the original PR #3866 review is fully closed. The
keep-core code arc for RFC-21 is now feature-complete; remaining
work is operations-side (integration testnet, manifest flip).

Test plan

• CI green.
• Reviewer confirms the per-reason quota independence is the right semantics (alternative: single per-sender reject counter).
• Reviewer confirms threshold = 1 for both reject and conflict (alternative: higher to absorb noise; trade-off is faster vs slower exclusion of misbehaving peers).