zkgm: settle call panics with failure acks

[notJoon]

Description

Closes #151

Fixes ZKGM receive and acknowledgement edge cases around only-maker and malformed acknowledgements.

The proven receive path now guards bare ACK_ERR_ONLY_MAKER results the same way as IntentRecv: retry-required only-maker outcomes abort receive processing so the packet receipt and acknowledgement are not committed.

CALL receiver panics are handled differently: they now produce a normal failure acknowledgement instead of being converted into only-maker. This matches the expected settlement behavior and lets the source side refund immediately, including zero-timeout packets.

The source-side ack dispatcher was also hardened for token-order, batch, and forward packets. Bare only-maker or undecodable token-order acknowledgements are treated as failure acknowledgements so token-order handlers take their refund path instead of causing permanent ack processing panics.

The realcometbls scenarios were updated because the expected behavior changed. A panicking CALL receiver, either top-level or inside a batch, now commits a decodable failure acknowledgement; token-order-first batch coverage verifies that a valid earlier token child can still settle while the later CALL child records failure.

Added focused impl tests covering:

• proven Recv aborting only on retry-required only-maker results
• CALL receiver panics producing failure acknowledgements
• OP_TOKEN_ORDER, OP_BATCH, and OP_FORWARD treating only-maker or malformed token-order acks as refund-triggering failures