feat: add Class A validator with four CEX adapters

[AK-APRIORIT]

Summary

Class A observes the same four CEX venues as the mainnet allowlist, derives CORE prices under the pinned parameter register, fail-closes on a bad candidate, and signs only frozen PACK(payload) bytes with a testnet key.

Minimum 3 matches the security baseline (≥3 healthy independent venues) and the availability rule that loss of one approved CEX must not block a healthy CORE update. Two remaining observations fail closed (INSUFFICIENT). Outlier exclusion is allowed only when three venues remain.

Binance/OKX XTZ and BTC routes stay USDT-quoted and are scaled by the same-round USDT_USD. Kraken and Coinbase are direct USD. Coinbase has no XTZ-USDT product; CORE uses Coinbase XTZ-USD. A synthetic XTZ/USDT = XTZ/USD ÷ USDT/USD helper exists for a later register row and is not the current CORE route.

Validator implementation (src/validator/)

• Adapters: Binance, OKX, Kraken, Coinbase — venue schema, timeouts, oversize bodies, host-changing redirects, malformed numbers, stale/future timestamps.
• Observe / derive: USDT_USD first (direct USD only), then XTZ_USD / BTC_USD with USDT conversion; median_lower; integer half_away_from_zero; oldest contributing observation time.
• Evidence: quorum-shared manifest and evidence_digest; signer-local record without secrets.
• Candidate verify: refuse altered price, policy, source, timestamp, or digest; no request-supplied policy.
• Signing: PACK(payload) only; TEZORACLE_SIGNER_SECRET_KEY from runtime config; local per-group round tracking. Golden vectors GV-01…GV-08 match the stored test-only ed25519 signatures.
• CLI: npm run validator -- derive|verify|sign. CI path uses deterministic fixtures (tests/validator/fixtures/cex-core.json).

Tests added

• Adapter parse and fail-closed HTTP/time cases
• Derivation medians; 3 venues succeed / 2 fail; one CEX timeout still derives CORE; outlier among four vs three
• Candidate mismatch (price, policy, endpoint, timestamp, digest)
• Golden-vector signing and round reuse
• CLI smoke (--help, fixture derive, refuse a bad candidate)
• Register assertions for min 3, four initial_phase venues, and a well-formed policy_hash