feat: complete Palace LEZ guest and deployment integration

[3esmit]

Source ownership

The Palace LEZ contract is owned here under program/. It contains versioned Borsh/Serde state, deterministic transition rules, a LEZ instruction envelope, and contract tests for the public two-room MVP.

Delivered guest and submit path

• Product-owned RISC Zero/SPEL guest at program/palace_program/methods/guest.
• One canonical public palace-state PDA, initialized by an authenticated owner and owned by the Palace program thereafter.
• LEZ account signer, state-owner, and PDA checks before deterministic Palace transitions.
• Guest host tests cover canonical initialization, stored state, owned-state transition, unauthorized rejection, and the serializer fixture used by Core.
• Methods build produces a Palace guest ELF and image ID from checked-in locked dependencies.
• Palace Core encodes checked transition words, submits LEZ public transactions with state non-signer/caller signer ordering, accepts only canonical successful transaction hashes, and records only successful submissions.

Remaining integration

• Publish the guest ELF with a release bytecode hash and testnet program ID.
• Add endpoint/network settings and indexed finalized-record recovery fixtures.
• Drive observed and finalized action stages from indexed LEZ records.
• Add adversarial guest and restart-reconstruction acceptance tests.

Acceptance

A clean Basecamp instance binds its Delivery key through the product-owned Palace program, submits a durable action, distinguishes submission from observed/finalized state, and rebuilds the same projection after restart.

[3esmit]

Implemented on the draft branch: Palace Core now submits through the generated universal LEZ proxy with a typed account list, typed signer list, and CBOR byte-string instruction payload. The action journal persists canonical successful transaction hashes in a checksummed atomic record; older submitted records migrate to explicit orphaned state rather than claiming recoverability. Core contracts and portable Core/UI packages build successfully.\n\nRemaining: deployed testnet program ID and bytecode binding, indexed observed/finalized record mapping, and clean restart/topology acceptance.

[3esmit]

Current main validation: node --test tests/*.test.mjs passes 260 tests (10 skipped live-only gates). The repository now carries a pinned release manifest and catalog package bindings, but this does not satisfy the remaining live acceptance by itself. The issue remains open for a fresh public-testnet run proving the deployed bytecode/program identity, indexed observed/finalized action mapping, creator-removal retention, and clean restart reconstruction. No new deployment identity or Program ID was inferred from local ImageIDs.

[3esmit]

Fresh main validation (2026-08-08): node --test tests/*.test.mjs passed 260 tests with 10 live-only skips. This confirms the local contract suite is green. The remaining acceptance is still external deployment evidence: a public Testnet program ID and bytecode binding, indexed observed/finalized mapping, creator-removal retention, and restart reconstruction. No deployment identity is inferred from local ImageIDs, so no code-only patch or release tag is safe yet.