cow-venue: full orderbook refusal taxonomy with escalating same-error backoff

[mfw78]

Watch-tower harvest car. Derives from handleOrderBookError in src/domain/polling/index.ts, the one part of watch-tower tuned by years of production refusals. Extends the #654 classification audit.

Extend classification.toml from the #654 three-row audit to watch-tower's full production refusal table, as data plus one small borsh retry-state row, with every would-be drop parked instead.

Why

The escalating same-error curve (backoff grows only while the same class repeats consecutively; acceptance resets it) is distilled orderbook behaviour worth adopting wholesale as data: 429 and 404 to ten minutes; 403 parks, never drops; TooManyLimitOrders to one hour; insufficient allowance or balance to ten minutes; InvalidAppData gets a one-minute grace then parks; timeouts are a class of their own, bounded below the liveness deadline; DuplicatedOrder stays success-equivalent per #121; InvalidEip1271Signature is not permanent, extending the #654 row. Per the refusal policy filed in #654 no class tears down a watch: watch-tower's permanent drops were false-permanents. The venue crate stays orderbook-only per #395, so this is data and a store row, not new verbs.

Scope

• Seam: the classification and escalation data live in cow-venue's classification.toml; the RetryState borsh row lives module-side in the local store, so the venue crate carries data only and the store row stays in module territory.
• classification.toml schema extension: optional per-class escalation = ["1m","10m","1h"], hot_retries, same_error_scoped.
• Borsh RetryState { class_digest, consecutive } on the watch; reset on acceptance.
• Local pre-submit sanity check (from src/domain/polling/filtering/badOrder.ts): obviously unpostable orders skip the round-trip and schedule, never tear down.
• Every watch-tower drop class maps to park with backoff.

Done when

• The full table is encoded as data with a test per class.
• Same-error escalation resets on acceptance, with a test.
• No refusal class removes a watch; the cow: reorg-aware ingestion and submission-policy pass #654 invariant is re-asserted against the extended table.
• The cow: cleave the cow venue from the composable-cow keeper #395 CI gate still shows zero composable symbols in cow-venue.

Blocked by: #654.

Blocked by: #654.