canton: scope replay tries by (consumer, namespace), not consumer alone

[bengtlofgren]

Why

NTT's CIP-56 rework (wormholelabs-xyz/native-token-transfers#43) makes a deployment's admin role transferable. A replay trie scoped solely to a consumer : Party therefore no longer works as the deployment's replay scope: transferring the admin would either strand the trie or force a dedicated identity party per deployment.

What

The trie scope key becomes (consumer, namespace): the consumer party keeps carrying the authority (NTT will use gg), and an opaque namespace : Text does the actual partitioning, so one controller party can maintain many independent tries.

• ReplayNode gains namespace : Text (ensure bounds it at 128 chars — it is copied into all 16 children on a split, so it must stay out of the documented node/split size budgets). ConsumeDigest is untouched: recreates and splits inherit the namespace via create this with.
• ClaimReplayRoot takes a namespace and stamps it on the claimed root. As before there is no uniqueness enforcement — the namespace is a free-form sub-scope under the consumer's authority, not a claim anyone else can contest; parallel roots under one scope remain consumer self-harm.
• VerifyAndConsumeVAA takes a namespace and asserts node.namespace == namespace beside the existing consumer/operator pins, so a node from the consumer's other trie fails cleanly instead of silently consuming there.

The core treats the namespace as opaque. NTT-side (follow-up in the other repo): derive it as "ntt:" <> keccak256(instrumentId + initial admin party) and check that equality onchain at RegisterManager.

wormhole-core is bumped 0.2.0 → 0.3.0 (template payload + choice-argument change; integrators vendor the DAR by version).

Tests

dpm build --all + dpm test: all 41 scripts pass.

• New testNamespaceScopes: one consumer, two namespaces — the same digest consumes in each, replays stay per-namespace, and a split in one trie leaves the other's single root untouched.
• testVerifyAndConsumeVAA extended: the same consumer consumes the same VAA under a second namespace; the namespace-mismatch case uses an unconsumed third-namespace root so only the new check can reject it (the same node then consumes fine with the right namespace).
• testTrieSplit asserts all 16 children inherit the namespace; testDepth63NeverSplits covers the ensure bound.
• Test helpers now simulate the disclosure-service index as (consumer, namespace, prefix); ExampleIntegrator carries a namespace and its two example apps share the string, demonstrating the party component alone still separates tries.

README §4.6/§4.7 updated to match.