predict: introduce expiry valuation boundary (DBU-557)

[0xaslan]

Summary

• Store an exact NavMark containing liability and computation timestamp on each expiry market.
• Add an independent refresh_nav operation that performs the existing full exposure walk and replaces the stored mark.
• Rewrite the hot-potato value_expiry step to read each expiry market immutably, preserve the existing per-market NAV floor, and reject marks older than three seconds or markets that reached expiry.

Why

• Full-pool flushes currently walk every active market and perform settlement or cash maintenance in one transaction, coupling NAV availability to the pool-wide object budget.
• Moving the exact liability walks into independent market transactions lets the flush retain its completeness proof while reading only compact market state.

Linear / Context

• DBU-557
• predict: refresh NAV per market and flush from stored marks (DBU-557) #1116 remains a reference for the broader earlier rewrite, not the design implemented here.

Key Decisions

• Marks contain only exact liability and computed_at_ms. There is no estimate, uncertainty, oracle anchor, or drift model.
• The flush preserves the existing free_cash minus liability per-market zero floor and total_nav aggregation.
• Cash rebalance, settlement, and sweeping are standalone prerequisites before the flush snapshots the active set.
• The three-second window knowingly accepts oracle movement and mint, redeem, or liquidation activity after refresh. It bounds mark age, not economic error magnitude.

Scope / Descoped

• No activity revision or invalidation, write-through accounting, drift calculation, estimate, uncertainty, oracle anchors, raw pool-level netting, event changes, configuration, tests, keeper changes, or deployment work.

Test Plan

• sui move build --path packages/predict --warnings-are-errors
• Add behavior and adversarial interleaving tests after the source shape settles.

Risk / Rollout

• Draft source foundation only. The accepted three-second stale-state window is intentionally unsafe and is not rollout-ready.