canton: guardianGovernance fee-pin

[bengtlofgren]

Summary

Emitter.PublishMessage, EmitterRegistry.RegisterEmitter, and ReplayRootRegistry.ClaimReplayRoot authenticate a caller-supplied CoreState contract before charging a fee through it, but the check only ever compared the operator field. operator does not determine guardianGovernance (the actual fee-custody trust anchor) — a genuine or compromised operator can co-sign a second, fully valid CoreState around an attacker-controlled guardianGovernance/feeRecipient, and the old check would accept it, redirecting real fee payments to the attacker. This was proven with a working PoC during review.

This adds:

• GetGuardianGovernance — a nonconsuming read choice on CoreState exposing its guardianGovernance field, mirroring the existing GetOperator pin idiom.
• An immutable guardianGovernance anchor field on Emitter/EmitterRegistry/ReplayRootRegistry (not a signatory — a pure trust reference, the same role operator already plays).
• A pin at all three fee-charging call sites: each now exercises GetGuardianGovernance on the caller-supplied CoreState and asserts it matches the committed anchor, before charging.

Test plan

• dpm build clean on both packages
• dpm test: 44/44 passing, including 3 new regression tests that build a genuine forged CoreState (real operator, rogue governance) and confirm each charge fails specifically on the new "guardianGovernance mismatch" check