Support Token-2022 in the test CLI

[kaze-cow]

Teaches the test CLI to work with Token-2022 mints. Split out of #120, which it stacks on.

What changes

ResolvedToken gains a token_program field: whichever of the two supported programs owns the mint and its token account. Everything the CLI builds against a resolved token — Approve, SyncNative, the ATA creation instruction, the associated token address derivation — is now issued against that program instead of assuming the legacy one.

Decoding moves to StateWithExtensions, so a mint or token account carrying Token-2022 extension data decodes instead of being rejected for having the wrong length. interpret_token_from_user_input tries the token account before the mint, since an extended mint can be as long as a token account and only the trailing account-type byte tells the two apart; there are unit tests pinning both directions of that.

The three resolution paths ("SOL"/"WSOL", a known alias, a base58 mint) all funnel through one resolve_from_mint helper that fetches the mint once and derives the ATA under the owning program.

determine_create_ata now takes the token account address the caller already derived, rather than re-deriving it from the mint under the legacy program. Under the old code an ATA on a non-legacy program was looked up at the wrong address and would always be reported as missing.

settle groups the buffers it needs to create by token program and emits one CreateBuffers per group, since a single instruction only accepts buffers for one program.

WSOL

SOL / WSOL now resolves the Token-2022 native mint (9pan9bMn5HatX4EJdBwg9VgCa7Uz5HL8N1m5D3NdXejP) instead of the legacy one. The two are equivalent for the CLI's purposes — wrap, sync, settle — and this exercises the Token-2022 path by default on every smoke test. Say the word if you'd rather keep the legacy mint and reach Token-2022 only through an explicit mint address.

Dependencies

test-cli moves from spl-token-interface to spl-token-2022-interface, which drops the last user of the legacy interface: the workspace entry #120 left in place for exactly this reason goes away here.

Out of scope

Integration tests covering Token-2022 across the settlement flow are in #121.

Test plan

just lint and just test are clean. The token module's new unit tests cover extension-aware decoding, mint/token-account disambiguation, and token program validation.

Manual smoke test against devnet is still worth doing: cargo run -p cow-test-cli -- sell --help and cargo run -p cow-test-cli -- settle --help, settling one order whose buy token is a Token-2022 mint and whose sell token is a legacy mint, which should produce two CreateBuffers instructions.

🤖 Generated with Claude Code

[linear-code]

SC-153